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ABSTRACT 


This  thesis  was  designed  as  a  reference  guide  for 
managers,  specifically  Commanding  Officers  and  Comptrollers, 
concerning  the  internal  control  system  and  control  programs. 
It  provides  a  general  overview  of  the  internal  control  system 
and  discusses  the  various  external  and  internal  audits, 
inspections,  reviews  and  investigative  organizations  and 
programs.  The  thesis  defines  the  audit  system  and  includes 
audit  standards  and  the  audit  process.  Practical  guidelines 
for  preparing  for  and  participating  in  audits  or  inspections 
are  included.  An  additional  reading  list  of  relevant  direc¬ 
tives  and  instructions  governing  the  various  programs  and 
agencies  is  intended  as  a  central  resource  for  managers  to 
obtain  additional  information. 
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I. 


INTRODUCTION 


A.  DISCUSSION 

Taxpayers  are  becoming  increasingly  concerned  with  how  the 
government  spends  its  money,  particularly  in  defense-related 
areas.  With  constant  discussions  concerning  the  spiraling 
budget  deficit  and  resultant  interest  payments,  the  media  and 
taxpayers  are  demanding  closer  scrutiny  of  the  budget  and  how 
government  funds  are  spent. 

Congress  attempts  to  control  wasteful  spending  through 
budget  restraints.  For  instance,  audit  reports  generally 
recommend  various  savings  and  benefits.  Theoretically,  if  the 
recommendations  are  enacted  by  the  auditee,  budget  savings 
should  accrue.  However,  if  these  recommendations  are  not 
implemented,  Congress  can  restrict  the  budget  to  the  amount  of 
the  projected  savings  under  the  assumption  that  an  efficiently 
managed  program  would  require  less  funding. 

The  Accounting  and  Auditing  Act  of  1950  required  internal 
control  systems  and  placed  the  responsibility  for  developing 
them  on  agency  heads.  The  Federal  Manager's  Financial 
Integrity  Act  of  1982  required,  among  others,  standard 
controls.  These  two  acts  created  various  programs. 
Specifically  in  the  Navy,  auditors  were  assigned  to  verify 
compliance  with  the  controls,  the  Internal  Review  Program  was 
developed  to  help  Commanding  Officers  assess  their  commands' 
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compliance  with  controls,  and  finally,  the  Management  Control 
Program  placed  responsibility  on  functional  managers  to  assure 
adequate  controls  exist  in  their  organizations. 

Although  these  programs  still  exist,  a  changing 
perspective  has  developed.  Auditors  rely  less  on  compliance 
audits  and  spend  more  of  their  time  assessing  the  effective¬ 
ness  and  efficiency  of  certain  programs  in  terms  of  monetary 
benefits.  Compliance  has  not  been  deleted  as  a  prime  concern, 
only  given  less  priority. 

Currently,  the  Naval  Postgraduate  School  teaches  the 
Practical  Comptrollership  Course  and  Financial  Management  in 
the  Armed  Forces  Course,  using  the  same  text  for  both.  The 
present  chapter  on  auditing  provides  a  detailed  background  on 
the  history  of  audits  and  controls  as  well  as  the  organiza¬ 
tions  involved.  It  does  not  offer  a  practical  approach  for 
preparing  and  participating  in  the  audit. 

Recent  policy  changes  throughout  the  audit,  review  and 
control  programs  need  to  be  incorporated  into  the  chapter. 
For  example,  the  Naval  Audit  Service,  within  the  past  couple 
of  years,  changed  its  audit  emphasis  from  the  short, 
compliance  audits  of  activities  to  the  longer,  more  complex 
program  audits.  A  second  example  involves  the  very  recent 
cancellation  of  the  Internal  Review  Program  by  the  Secretary 
of  the  Navy. 
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B.  PURPOSE  OF  RESEARCH 

The  primary  purpose  of  this  thesis  was  to  develop  a 
practical  reference  guide  for  managers,  specifically 
Commanding  Officers  and  Comptrollers,  concerning  the  internal 
control  system  and  control  programs.  This  guide  will  be 
incorporated  into  the  text  used  in  the  Practical 
Comptrollership  Course  and  Financial  Management  in  the  Armed 
Forces  Course  at  the  Naval  Postgraduate  School. 

C.  SCOPE  OF  RESEARCH 

This  thesis  reviews: 

-  current  control,  audit,  and  review  policies. 

standards  for  internal  controls,  audits  and  the  audit 
process . 

information  regarding  the  various  audit,  investigation 
and  review  organizations  which  affect  the  Navy. 

guidelines  for  preparing  and  participating  in  an  audit. 

rights  for  the  audited  organization. 

Since  the  purpose  of  the  thesis  is  to  develop  a  desktop 
reference  guide,  a  synopsis  was  used,  providing  necessary 
information  for  the  understanding  of  the  programs  and 
standards.  Instructions  and  directives  provide  full  details 
and  discussions  for  each. 

D.  RESEARCH  APPROACH 

Research  for  this  thesis  covered  two  areas:  an  exhaustive 
review  of  pertinent  directives  and  instructions,  and 
interviewing  various  managers.  Interviews  with  program 
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headquarters’  staff  facilitated  a  better  understanding  and 
clarity  of  the  written  directives.  Interviews  with  field 
managers  provided  experienced  advice  for  participating  in 
audits,  reviews  and  inspections. 

Due  to  the  variety  of  agencies  and  programs  examined  in 
this  thesis,  no  standard  questionnaire  was  developed. 
Information  gathered  through  the  interview  process  was  the 
result  of  free-form  commentary,  personal  and  phone  interviews 
from  members  of  various  comptroller  departments,  at  all 
levels;  commanding  officers;  former  internal  review  staff 
members;  and  field  auditors  of  the  Naval  Audit  Service,  as 
well  as  headquarters  staff  of  the  various  audit,  review  and 
inspection  agencies.  Interviews  lasted  between  45  and  90 
minutes . 

Interviewees  included  the  following  commands  and  agencies: 

Office  of  Inspector  General,  Department  of  Defense. 

Office  of  Inspector  General,  Department  of  the  Navy. 

Naval  Military  Personnel  Command. 

Naval  Supply  Systems  Command  Headquarters. 

Navy  Accounting  and  Finance  Center,  Washington,  D.C. 

Naval  Audit  Service,  Washington,  D.C. 

Commander  in  Chief,  U.S.  Pacific  Fleet  (CINCPACFLT) , 

Pearl  Harbor. 

Naval  Air  Force,  U.S.  Pacific  Fleet  (AIRPAC) ,  San  Diego. 

Naval  Surface  Force,  U.S.  Pacific  Fleet  (SURFPAC) . 

Naval  Postgraduate  School,  Monterey. 
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Naval  Air  Station,  Alameda. 

Naval  Air  Station,  Whidbey  Island. 

Naval  Air  Station,  Lemoore. 

Naval  Sub  Base,  Bangor. 

Defense  Investigative  Service,  Monterey. 

Naval  Investigative  Service,  Resident  Agency,  Monterey. 

E.  THESIS  ORGANIZATION 

The  thesis  is  organized  as  follows:  Chapter  I  provides 
the  methodology  and  scope  of  the  thesis.  Chapter  II  gives  a 
general  overview  of  the  internal  control  system  and  discusses 
the  various  external  and  internal  audits,  inspections,  reviews 
and  investigative  organizations  and  programs.  Chapter  III 
defines  the  audit  system,  and  includes  audit  standards  and  the 
audit  process.  Chapter  IV  provides  practical  guidelines  for 
preparing  for  and  participating  in  audits  or  inspections. 

Finally,  an  additional  readings  list  is  attached  as  an 
appendix.  This  detailed  list  of  the  directives  and 
instructions  governing  the  various  programs  and  agencies  is 
intended  as  a  central  resource  for  managers  to  obtain 
additional  information  relevant  to  each  chapter. 
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II. 


INTERNAL  CONTROL  SYSTEM 


This  chapter  introduces  the  topics  of  management  control 
and  auditinq  in  the  Navy,  including  various  external  and 
internal  audit  organizations  and  programs,  Inspector  General 
(IG)  inspections,  internal  review  organizations  as  well  as  the 
Management  Control  Program. 

A.  REASONS  FOR  MAINTAINING  A  CONTROL  SYSTEM 

An  entity's  management  is  responsible  for  establishing 
an  internal  control  structure  to  assure  compliance  with  laws 
and  regulations.  The  lack  of  administrative  continuity  in 
government  units  because  of  continuing  changes  in  elected 
legislative  bodies  and  in  administrative  organizations 
increases  the  need  for  an  effective  internal  control  system. 
[Ref.  1 : p .  4-2] 

In  an  era  of  decreasing  resources  due  to  budget  deficits 
and  competing  requirements,  federal  government  financial 
managers  should  actively  promote  economy,  effectiveness  and 
efficiency  when  expending  financial  resources.  This  entails 
strong  management  controls.  To  provide  "maximum  benefit  with 
minimum  effort  (efficiency)"  [Ref.  2:p.  20]  without 
considering  the  cost  implications  (economy)  or  ability  to 
achieve  one's  mission  (effectiveness)  does  a  disservice  to  the 
federal  government  and  management's  role  in  preserving  the 
integrity  of  the  financial  affairs  of  the  government.  [Ref. 

2 : p .  20] 
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With  increasing  oversight  from  the  media,  Congress  and  the 
public,  failure  to  use  financial  resources  economically, 
efficiently  and  effectively  could  result  in  funds  recoupment 
by  higher  authority. 

Through  the  reports  generated  by  the  various  audit  and 

control  agencies,  Congress  attempts  to  promote  greater 

economy,  effectiveness,  and  efficiency  by  controlling  and 

restraining  those  areas  of  the  budget  which  are  identified  in 

the  reports  as  areas  of  concern  and  weakness.  Managers  must 

take  strong  action  to  correct  these  areas  or  face  budget 

sanctions.  For  example,  in  1985, 

...the  House  Committee  on  Armed  Services  has  become  aware  of 
the  Navy  inaction  in  improving  its  internal  audit  function 
and,  to  emphasize  its  concern,  deleted  $100  million  from  the 
Navy  Fiscal  Year  1988  (FY88)  Operation  and  Maintenance 

budget  request.  The  Government  Accounting  Office  (GAO) 
concluded  the  congressional  message  is  that  an  effective 
Navy  audit  organization  would  have  identified  at  least  $100 
million  in  potential  monetary  benefits  from  its 
recommendations.  [Ref.  3:p.  64] 

The  periodic  rotation  of  managers  provides  opportunities 
for  inefficiency  or  fraud  since  managers  typically  are 
concerned  with  short-term  goals  at  the  expense  of  long-term 
results.  With  a  good  control  system,  managers  have  set 
performance  standards  with  which  to  judge  organizational 
effectiveness,  allowing  weaknesses  to  be  detected  and 
corrected.  Problem  areas  not  internally  detected  may  be 
detected  through  other  control  systems  such  as  external  audits 
or  inspections. 
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As  a  control  measure,  audits  and  inspections  keep  managers 


informed  of  areas  of  strength,  weakness  or  possible 
misrepresentation  by  employees.  Audits  and  inspections  serve 
as  an  instrument  with  which  to  recognize  outstanding 
performance,  and  as  a  deterrence  against  fraud,  waste  and 
abuse.  The  potential  for  fraud,  waste  or  abuse  is  diminished 
if  the  staff  expects  an  independent  third-party  review  and 
verification  of  their  respective  actions. 

A  good  internal  control  and  review  system  helps  management 
recognize  deficiencies  thus  allowing  an  opportunity  for 
immediate  identification  of  problem  areas  and  required 
corrective  action.  It  also  helps  to  identify  potential  repeat 
audit  findings. 

A  well-run  organization  should  welcome  audits  and  reviews 
for  two  reasons.  Problem  areas  identified  in  an  audit  can  be 
corrected,  developing  a  more  efficient  and  effective 
organization;  and  those  organizations  with  no  problems  can  be 
recognized  as  such  due  to  the  lack  of  audit  findings.  [Ref. 
4] 


B.  THE  INTERNAL  CONTROL  STRUCTURE 

Auditing  textbooks  define  the  internal  control  structure 
to  "include  the  control  environment,  the  accounting  system  and 
the  control  procedures."  [Ref.  5:p.  274]  According  to  the 
Comptroller  General,  "good  internal  controls  are  essential  to 
achieving  the  proper  conduct  of  Government  business  with  full 
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accountability  for  the  resources  made  available."  [Ref.  6:p. 
1] 


The  control  environment  reflects  the  overall  philosophy  of 
top  management.  [Ref.  5:p.  274]  Department  of  Defense  (DOD) 
philosophy  states 

Internal  controls  are  management's  responsibility  and  should 
be  in  effect  across  the  board  in  every  organization  within 
each  DOD  component.  Adequate  internal  control  is  required 
to  assure  that  all  resources  are  efficiently  and  effectively 
managed  and  is  the  basic  foundation  for  integrity  in  any 
management  system.  Although  internal  controls  in  themselves 
cannot  prevent  every  incident  of  waste,  mismanagement,  and 
fraud,  DoD  policy  is  to  ensure  that  resources  are  properly 
managed  and  controlled  within  the  Department  of  Defense. 
[Ref.  7 : p .  1] 

The  accounting  system  pertains  to  the  control  over  the 
entity's  transactions  and  the  related  assets.  [Ref.  5:p.  274] 

The  Accounting  and  Auditing  Act  of  1950  requires  agency 
heads  to  establish  and  maintain  effective  systems  of  internal 
control .  The  objectives  require  that: 

a.  Obligations  and  costs  comply  with  applicable  law 

b.  Assets  are  safeguarded  against  waste,  loss,  unauthorized 
use,  and  misappropriation 

c.  Revenues  and  expenditures  applicable  to  agency 
operations  are  recorded  and  accounted  for  properly  so  that 
accounts  and  reliable  financial  and  statistical  reports  may 
be  prepared  and  accountability  of  the  assets  may  be 
maintained.  [Ref.  6 : Introduction] 

Although  the  objectives  of  internal  controls  seem  to 
indicate  that  financial  programs  are  the  only  programs  which 
are  of  concern,  this  is  not  the  intent.  Internal  controls 
apply  to  all  programs,  administrative  and  operational.  [Ref. 
8 : p .  9] 
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Control  procedures  allow  management  to  meet  these 
objectives.  [Ref.  6:p.  1]  The  control  procedures  established 
in  an  organization  reflect  the  minimum  level  of  quality 
performance  required.  [Ref.  6:p.  2]  An  effective  control 
system  can  diminish,  but  not  necessarily  eliminate,  the 
opportunity  for  collusion  or  fraud. 


C.  TYPES  OF  CONTROLS 

Government  controls  are  classified  as  either  general, 
specific  or  audit  resolution  standards.  These  controls  were 
developed  by  the  Comptroller  General  as  a  requirement  of  the 
Federal  Managers'  Financial  Integrity  Act  of  1982  (31  U.S.C. 
3512(b)).  Office  of  Management  and  Budget  (OMB)  Circular  No. 
A-123  revised,  dated  August  16,  1983  has  a  full  discussion  of 
the  standards. 

1.  General  Standards 

a.  Reasonable  Assurance.  Internal  control  systems  are 
to  provide  reasonable  assurance  that  the  objectives  of  the 
systems  will  be  accomplished.  The  benefits  derived  should 
exceed  the  cost  of  the  internal  control  system.  The 
benefits  should  reduce  the  risk  of  failing  to  achieve  the 
control  objectives. 

b.  Supportive  Attitude.  Managers  and  employees  are  to 
maintain  and  demonstrate  a  positive  and  supportive  attitude 
toward  internal  controls  at  all  times. 

c.  Competent  Personnel.  Managers  and  employees  are  to 
have  personal  and  professional  integrity.  They  are  to 
maintain  a  level  of  competence  that  allows  them  to 
accomplish  their  assigned  duties,  as  well  as  understand  the 
importance  of  developing  and  implementing  good  internal 
controls . 
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d.  Control  Objectives.  Internal  control  objectives  are 
to  be  identified  or  developed  for  each  agency  activity  and 
are  to  be  logical,  applicable,  and  reasonably  complete. 

e.  Control  Techniques.  Internal  control  techniques  are 
to  be  effective  and  efficient  in  accomplishing  their 
internal  control  objectives.  Control  techniques  promote 
consistent  performance. 

2.  Specific  Standards 

a.  Documentation.  Internal  control  systems  and  all 
transactions  and  other  significant  events  are  to  be  clearly 
documented,  and  the  documentation  is  to  be  readily  available 
for  examination. 

b.  Recording  of  Transactions  and  Events.  Transactions 
and  other  significant  events  are  to  be  promptly  recorded  and 
properly  classified. 

c.  Execution  of  Transactions  and  Events.  Transactions 
and  other  significant  events  are  to  be  authorized  and 
executed  only  by  persons  acting  within  the  scope  of  their 
authority.  Authorizations  are  to  be  made  in  writing. 

d.  Separation  of  Duties.  Key  duties  and  responsibili¬ 
ties  in  authorizing,  processing,  recording,  and  reviewing 
transactions  should  be  assigned  to  separate  individuals  to 
minimize  the  risk  of  loss  to  the  government. 

Internal  control  depends  largely  on  the  reduced 
opportunities  to  make  and  conceal  errors  or  to  engage  in  or 
conceal  irregularities.  This,  in  turn  depends  on  the 
assignment  of  work  so  that  no  one  individual  controls  all 
phases  of  an  activity  or  transaction,  thereby  creating  a 
situation  that  permits  errors  or  irregularities  to  go 
undetected. 

e.  Supervision.  Qualified  and  continuous  supervision 
is  to  be  provided  to  ensure  that  internal  control  objectives 
are  achieved,  and  approved  procedures  are  followed. 

Lines  of  personal  responsibility  and  accountability  are 
to  be  clearly  established. 

f.  Access  to  and  Accountability  for  Resources.  Access 
to  resources  and  records  is  to  be  limited  to  authorized 
individuals,  and  accountability  for  the  custody  and  use  of 
resources  is  to  be  assigned  and  maintained.  Periodic 
comparison  shall  be  made  of  the  resources  with  the  recorded 
accountability  to  determine  whether  the  two  agree.  The 
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frequency  of  the  comparison  shall  be  a  function  of  the 
vulnerability  of  the  asset. 

3.  Audit  Resolution  Standard 

a.  Prompt  Resolution  of  Audit  Findings.  Managers  are 
to  (1)  promptly  evaluate  findings  and  recommendations 
reported  by  auditors,  (2)  determine  proper  actions  in 
response  to  audit  findings  and  recommendations,  and  (3) 
complete,  within  established  time  frames,  all  actions  that 
correct  or  otherwise  resolve  the  matters  brought  to 
management's  attention.  [Ref.  9:p.  6-8] 

D.  INTERNAL  CONTROL  SYSTEMS 

The  major  systems  of  internal  control  for  the  Department 
of  the  Navy  include  formal  audits,  economy  and  efficiency 
reviews  (formerly,  internal  review)  and  the  Management  Control 
Program.  These  management  tools  help  ensure  the  integrity  of 
the  system  and  complement  each  other.  Controls  form  the  basis 
from  which  audits  and  reviews  are  performed. 

The  chief  differences  between  the  programs  reflect  the 
level  of  independence  provided  to  the  command  being  inspected, 
audited  or  reviewed. 

Audits  are  the  formal  program  which  management  can  use  to 
evaluate  its  control  system.  Audits  differ  from  management 
control  reviews  and  economy  and  efficiency  reviews  in  that 
they  are  performed  by  qualified  professional  auditors 
following  GAO  Audit  standards.  These  auditors  are  independent 
from  the  influence  of  the  function  being  audited.  Audit 
results  are  made  available  to  those  interested,  including 
Congress,  and  other  auditing  and  inspection  agencies. 
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Economy  and  efficiency  reviews  lie  strictly  within  the 
confines  of  the  command  for  the  Commanding  Officer's  sole  use 
as  an  internal  assessment  of  the  control  system.  Personnel 
assigned  to  the  command  conduct  the  reviews.  The  findings  are 
confidential  and  not  released  outside  the  command;  thus,  the 
Commanding  Officer  has  the  incentive  to  investigate  and 
correct  problem  areas  promptly. 

The  Management  Control  Program  is  a  review  performed  by 
the  managers  themselves  to  determine  whether  their  functional 
area  has  adequate  internal  controls  based  on  levels  of 
vulnerability  and  risk.  Review  results  are  incorporated  into 
the  command's  consolidated  report.  The  Commanding  Officer 
determines  which  areas  are  reported  to  the  next  level  in  the 
chain  of  command.  Each  echelon  level  command  merges  the 
reports  until  they  are  consolidated  at  the  DOD  level  into  a 
joint  service  report  that  is  presented  to  Congress  and  the 
President. 

E.  EXTERNAL  AUDIT,  INVESTIGATIVE  AND  INSPECTION  ORGANIZATIONS 

Since  reports  from  external  (to  the  DON)  organizations 
sometimes  recommend  areas  where  economic  savings  could  accrue, 
any  concurrence  could  affect  future  budget  plans.  If  managers 
do  not  agree  with  the  findings,  they  should  justify  their 
rationale  for  not  concurring.  For  example,  a  manager  could 
request  additional  sampling  if  the  original  sample  was  not  an 
accurate  portrayal  of  events. 
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1 .  Conaressionallv  Controlled  Oversight  Organizations 


The  Government  Accounting  Office  (GAO)  is  responsible  for 
making  independent  evaluations  of  agencies  and  functions  of 
the  Executive  Branch  of  the  government ....  GAO  reports 
generally  contain  findings,  conclusions  and  recommendations 
that  identify  problems,  highlight  areas  where  management 
could  be  improved,  and  offer  potential  corrective  actions. 
The  reports  have  a  substantial  impact  on  Congressional  and 
public  views  concerning  DON  activities.  [Ref.  10 :p.  1] 

The  Surveys  and  Investigations  Staff  of  the  House 
Appropriations  Committee  reviews  Navy  programs  for  Congress. 
Since  the  reviews  are  not  conducted  by  professional  auditors, 
they  are  not  bound  by  the  strict  GAO  Standards  or  audit 
objectives.  Thus,  their  conclusions  and  recommendations  may 
not  be  statistically  accurate. 

2 .  Military  Oversight  Organizations 

The  following  major  operational  audit  and  inspection 

organizations  are  designed  to  meet  DOD  policy 

...to  provide  adequate  audit  coverage  of  all  DoD  organiza¬ 
tions,  programs,  activities,  and  functions  as  an  integral 
part  of  the  DOD  management  system.  The  objectives  of 
auditing  are  to  conduct  independent  evaluations  of  DOD 
programs  and  operations,  and  to  determine  whether  internal 
control  systems  are  adequate;  information  is  reliable; 
applicable  laws,  regulations  and  policies  are  followed; 
resources  are  safeguarded  and  managed  economically  and 
efficiently;  and  desired  program  results  are  achieved. 
[Ref.  ll:p.  1-2] 

a.  Inspector  General 

(1)  DOD  Inspector  General  (DODIG^ . 

The  Inspector  General  is  required  to. .. conduct ,  supervise, 
monitor,  and  initiate  audits  and  investigations  relating  to 
programs  and  operations  of  the  DOD;  provide  leadership  and 
coordination  and  recommend  policies  for  activities  designed 
to  promote  economy,  efficiency,  and  effectiveness  in  the 
administration  of,  and  to  prevent  and  detect  fraud  and  abuse 
in,  such  programs  and  operations;  provide  a  means  for 
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keeping  the  Secretary  of  Defense  and  the  Congress  fully  and 
currently  informed  about  problems  and  deficiencies  relating 
to  the  administration  of  such  programs  and  operations  and 
the  necessity  for  and  progress  of  corrective  action.  [Ref. 

12 : p .  1-2] 


The  major  thrust  of  IG  inspections  centers  on 
mission  economy  and  effectiveness,  and  reviewing  special 
interest  items.  These  inspections  differ  from  audits  in  that 


they  are 

not  performed  by 

professional 

auditors  nor 

are 

auditing 

standards 

followed 

.  They  are 

very  limited 

in 

duration, 

generally 

lasting 

a  few  weeks 

versus  months 

or 

years. 


Special  interest  items  are  the  result  of 
Congressional  interest  and/or  common,  recurring  discrepancies 
found  during  inspections.  The  major  high  interest  items  for 
FY90  are  DOD  Environmental  Program?  Health  Care?  Defense 
Management  Report?  Manpower  and  force  structure?  product 
substitution,  defective  pricing  and  poor  accounting  systems. 
IG  teams  routinely  investigate  hotline  tips.  [Ref.  13] 

DOD  IG  is  a  civilian  appointed  by  the 
President  with  the  consent  of  the  Senate.  [Ref.  12 :p.  1-2] 

(2)  Department  of  the  Navy  fDON]  Inspector 
General  CNAVINSGEN^ . 

As  the  principle  advisor  on  all  inspection  and  noncriminal 
investigation  matters  it  : s  intended  that  NAVINSGEN  act  as 
the  "eyes  and  ears"  of  SECNAV,  CNO  and  CMC  in  all  integrity 
and  efficiency  matters.  The  term  "inspection"  encompasses 
not  only  command  inspections,  but  the  efforts  of  any  group 
or  person  within  the  DON  who  evaluates  units  and  activities. 
This  term  encompasses  all  examinations  and  inquiries  into 
any  matter  in  which  DON  has  interest  which  are  not  included 
in  NAVINSGEN's  annual  integrity  and  efficiency  plan.  [Ref. 
14:p.  2] 
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These  inspections  concentrate  on  compliance 
an ^  operational  issues.  NAVINSGEN  is  a  military  component  of 
the  Office  of  the  Secretary  of  the  Navy.  The  IG  teams  are 
normally  comprised  of  a  permanent  cadre  of  military  and  DON 
civilian  personnel,  occasionally  supplemented  with  subject 
area  experts  from  the  field. 

Major/sub  claimant  IG  teams  operate  under  the 
NAVINSGEN  instruction.  All  reports  are  sent  to  NAVINSGEN. 

OPNAVINST  5040  lists  the  NAVINSGEN  special 
interest  items.  Appendix  A  lists  common  discrepancies  found 
during  command  inspections. 

b.  Defense  Contract  Audit  Agency 

The  Defense  Contract  Audit  Agency  provides 
contract  audit  services  as  well  as  accounting  and  financial 
advisory  services  to  all  DOD  activities  responsible  for 
procurement  and  contract  administration.  [Ref.  15 :p.  1]  The 
director,  a  civilian  selected  by  the  Secretary  of  Defense, 
receives  agency  direction  and  authorization  from  the  Assistant 
Secretary  of  Defense  (Comptroller) . 

c.  Naval  Audit  Service 

The  Naval  Audit  Service  is  the  central  audit 
agency  for  the  Navy. 

The  mission  of  the  Naval  Audit  Service  is  to  perform 
internal  audits  of  DON  organizations,  programs,  systems, 
activities,  functions  and  funds  and  to  issue  reports  on 
these  audits  that  describe  conditions  found  and  any 
corrective  actions  needed.  [Ref.  16] 
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The  major  focus  of  the  Naval  Audit  Service  is 
concentrated  on  large,  high-dollar  value,  multi-function 
program  audits.  As  a  result,  the  audit  may  take  up  to  a  year 
or  more  to  complete. 

The  Naval  Audit  Service  performs  other  functions,  such  as 
providing  audit  policy  guidance,  surveillance,  and  review  of 
audits  conducted  by  nonappropriated  fund  organization 
auditors;  monitoring  Department  of  the  Navy  contracts  for 
audit  services  to  ensure  compliance  with  DOD  guidance; 
supporting  the  Naval  Inspector  General  in  executing  the 
Department  of  the  Navy  Audit  Follow-up  Program;  serving  as 
the  focal  point  for  internal  audit  policy  relative  to  the 
Department  of  the  Navy  Management  Control  Program,  and 
providing  audit  assistance  to  the  Naval  Investigative 
Service  Command.  [Ref.  17 :p.  2] 

Additionally,  a  limited  management  consulting 
service  is  available  upon  request.  This  service  differs  from 
an  audit  because  the  report  remains  confidential  and  is  not 
released  to  outside  parties. 

The  Auditor  General  of  the  Navy  determines  whether 
the  management  consulting  service  is  more  appropriate  than  an 
audit.  The  Naval  Audit  Service  will  recommend  an  audit  if  the 
initial  investigation  determines  fraud  or  waste  may  exist,  and 
will  immediately  prioritize  the  consulting  request  into  the 
audit  plan.  When  resources  become  available,  an  audit  will  be 
conducted.  [Ref.  18] 

The  Auditor  General  of  the  Navy,  a  career  civil 
servant,  is  directly  subordinate  to  the  Under  Secretary  of  the 
Navy  and  serves  in  three  capacities:  Auditor  General  of  the 
Navy;  Director,  Naval  Audit  Service;  and  Executive  Staff 
Extension  of  the  Under  Secretary  of  the  Navy.  [Ref.  17:p.  2] 
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Appendix  B  discusses  the  current  operational  and 
organizational  structure  of  the  Naval  Audit  Service,  and 
provides  selections  from  the  current  audit  plan. 

d.  Naval  Investigative  Service  Command  (NIS) 

NIS  maintains  specialized  fraud  units  throughout 
the  world  to  investigate  fraud  and  criminal  activities.  [Ref. 
19]  Auditors  are  not  trained  to  perform  criminal  investiga¬ 
tions.  If  potential  evidence  of  fraud  or  other  criminal 
activity  is  uncovered  during  an  audit,  the  auditor  can  expand 
the  scope  of  the  audit  to  verify  the  evidence.  If  verified, 
the  auditor  furnishes  a  written  report  of  the  suspected 
activities  to  the  director  or  director's  superior,  the  Naval 
Inspector  General  and  Naval  Investigative  Service  Command  for 
investigation. 

The  NAVIG  and  Naval  Investigative  Service  Command  then 
will  determine  at  what  level  to  brief  any  known  or  suspected 
instances  of  illegal  actions.  Where  criminal  activity  is 
suspected  during  the  audit,  any  notification  or  dissemina¬ 
tion  of  audit  reports  will  be  coordinated  with  the  Naval 
Investigative  Service  Command.  This  is  to  preclude 
compromise  of  the  investigation  or  destruction/alteration  of 
evidence.  [Ref.  17:p.  7] 

F.  INTERNAL  ASSESSMENT  PROGRAMS 

These  reviews  are  conducted  by  personnel  attached  to  the 
command . 

1 .  Internal  Review 


Internal  Review  provided  Commanding  Officers  an 
internal  asset  to  assess  the  economy  and  effectiveness  of 
their  command  functions.  The  reports  generated  by  the 
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command's  Internal  Review  staff  were  for  the  Commanding 
Officer's  sole  use  and  were  strictly  confidential.  This  gave 
the  Commanding  Officer  the  flexibility  to  direct  the  Internal 
Review  staff  to  review  areas  of  concern  without  delay.  Since 
the  results  of  these  reviews  remained  within  the  command,  the 
Commanding  Officer  could  be  assured  of  confidentiality  thus 
providing  an  incentive  for  self-identification  and  correction 
of  command  problem  areas. 

In  1989,  SECNAVINST  7510.9  canceled  Internal  Review  as 
a  required  program;  however  Commanding  Officers  remain 
responsible  for  their  command's  economy  and  efficiency.  They 
have  the  option  of  organizing  their  staff  to  perform  reviews 
in  a  manner  which  is  most  effective  for  the  command. 

SECNAVINST  7510.9  requires  any  review  termed  "audit" 
to  comply  with  GAO  and  Naval  Auditing  Standards,  be  performed 
by  professional  auditors  and  reviewed  by  the  Navy  Auditor 
General.  When  this  occurs,  the  review  no  longer  is 
confidential  and  can  be  made  available  to  outside,  interested 
parties.  Since  these  reviews  were  initially  intended  to  be  a 
confidential  management  tool  for  the  commanding  officer's  sole 
use,  the  majority  of  commands  have  replaced  the  term  "audit" 
with  "study,"  "evaluation,"  "review,"  "inspection,"  or  "quick 
look"?  and  have  changed  the  job  series  classifications  of 
their  review  staff  from  GS-511  (Auditor)  to  GS-510  (Accoun¬ 
tant)  or  CS-34 3  (Management  Analyst) .  However,  interviewees 
stated  they  will  continue  to  follow  tne  audit  standards. 
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Economy  and  efficiency  reviews  "focus  on  areas  to 
reduce  costs  of  operations,  increase  production  and  eliminate 
waste,  fraud  and  abuse."  [Ref.  20:p.  2]  Areas  generally 

covered  include  the  appropriated  and  non-appropriated 
activities  for  financial  compliance.  Major  echelon  commanders 
have  developed  specific  policy  and  guidance  in  this  matter. 

Commands  are  required  to  provide  an  audit  liaison 
service  for  outside  agencies  to  conduct  audits,  reviews  and 
inspections . 

Liaison  includes  the  following: 

1.  providing  administrative  support; 

2.  arranging  for  suitable  office  space  and  equipment; 

3.  coordinating  dates,  times  and  locations  for  entrance  and 
exit  conferences; 

4 .  determining  points  of  contact  within  various  functional 
areas ; 

5.  maintaining  pertinent  records; 

6.  coordinating  management  responses  to  findings  and 
recommendations;  and 

7.  coordinating  audit  resolution  efforts  between  audit 
agencies  and  managers.  [Ref.  21:p.  4] 

2 •  Management  Control  Program 
a.  Definition 

The  Management  Control  Program  is  the  formal 
process  of  an  organization  which  evaluates  whether  internal 
controls  exist  and  are  effective  throughout  the  organization. 
The  Management  Control  Review  is  "a  detailed  examination  by  a 
responsible  manager  on  an  area  to  determine  the  adequacy  of 
controls  and  to  identify  and  correct  deficiencies  and 
weaknesses."  [Ref.  22 :p.  1]  This  is  a  "do-it-yourself"  type 
program,  where  managers  assess  the  control  system.  Management 


20 


controls  are  in  compliance  with  the  program  if  they  follow  the 
objectives  of  internal  controls: 


1.  The  Accounting  control  is  responsible  for  safeguarding 
resources  and  assuring  accuracy  and  reliability  of 
information. 

2.  The  Administrative  control  assures  adherence  to  laws, 
regulations,  and  policies  and  also  promotes  efficiency  and 
economy.  [Ref.  23] 

b.  The  Basic  Program 

The  basic  program  consists  of  six  steps. 

(1)  Assign  Management  Responsibilities.  The 
Commanding  Officer  has  overall  responsibility  for  the  program 
and  must  sign  all  reports,  or  in  his/her  absence,  the 
Executive  Officer  may  sign.  All  line  managers  perform 
assessments  and  reviews  or  document  the  reviews  and  testing  of 
controls  performed  by  audits,  inspections  or  other  reviews. 

(2)  Segment  the  Organization.  Segment  the 
organization  into  meaningful  assessable  units.  An  assessable 
unit  is  any  entity  capable  of  being  evaluated  by  management 
control  procedures,  for  example,  minor  property.  These  units 
should  relate  directly  to  a  responsible  manager. 

(3)  Risk  Assessments.  Risk  assessments  determine 

the  susceptibility  or  vulnerability  of  a  program  to 

mismanagement  due  to  fraud,  waste  or  abuse. 

Assessments  are  a  quick  look  at  an  assessable  unit,  based  on 
an  individual's  (manager's)  knowledge,  experience,  and 
personality.  Yes,  even  personality  because  the 
applicability  and  degree  of  adequacy  or  acceptability  varies 
with  each  individual.  But  given  the  same  information  the 
overall  results  of  an  assessment  will  generally  fall  in  the 
same  range  of  vulnerability.  [Ref.  23] 
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The  Vulnerability  Assessment  Form  (Navcompt 
Form  2283)  (see  Appendix  C  for  an  example)  analyzes  the 
general  control  environment,  the  inherent  risk  and  existing 
safeguards  or  controls.  The  Vulnerability  Assessment  Form  is 
suggested  but  not  mandatory.  However,  an  alternative  risk 
assessment  must  follow  the  intent  of  the  OMB  guidelines. 

The  alternative  risk  assessment  is  based  on 
the  results  of  audits,  IG  inspections,  or  reviews,  and  the 
manager's  knowledge  and  experience.  Specific  documentation  is 
required  concerning  how  the  alternative  risk  assessment  was 
performed  and  what  was  considered. 

(4)  The  Management  Control  Plan.  The  Management 
Control  Plan  is  a  brief  plan,  updated  annually,  which  gives 
the  number  of  risk  assessments,  the  number  of  reviews  planned 
based  on  the  list  of  assessable  units,  their  risk  ratings  and 
how  the  evaluations  are  to  be  performed.  This  plan  schedules 
control  evaluations  over  a  five-year  period  and  is  tied  to  IG 
inspections  and  annual  audits  to  avoid  duplication  of  efforts. 

(5)  The  Management  Control  Review.  The  Manage¬ 
ment  Control  Review  is  a  detailed  review  examining  the  general 
control  conditions,  within  the  event  cycles.  An  event  cycle 
is  "series  of  steps  taken  to  get  something  done"  [Ref. 
24:Encl,  p.  1]  or  the  steps  used  to  accomplish  the  goals  of 
the  unit.  This  includes  all  the  documents  and  activities 
needed  to  take  a  process  from  start  to  finish.  [Ref.  23]  It 
is  conducted  by  the  responsible  manager  to  identify  weak  or 
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excessive  controls  and  to  provide  appropriate  corrective 
actions.  Excessive  controls  are  inefficient  because  the  cost 
for  maintaining  the  controls  exceed  the  benefits  achieved. 

All  assessable  units  must  be  reviewed  during 
the  five  year  cycle  regardless  of  the  risk  factor.  Functions 
which  have  a  high  risk  factor  are  required  to  be  reviewed 
within  the  first  two  years  of  the  five  year  cycle.  A  low  or 
medium  factor  may  or  may  not  require  a  review  during  the  first 
two  years,  depending  on  the  directions  from  the  chain  of 
command.  [Ref.  23] 

(6)  The  Annual  Management  Control  Certification 
Statement.  The  Annual  Management  Control  Certification 
Statement  (see  Appendix  C)  is  sent  to  the  next  higher  level  in 
the  chain  of  command  documenting  accomplishments,  material 
weaknesses,  the  risk  assessment  report  and  management  control 
plan.  Proof  of  corrective  actions  taken  must  be  attached  to 
the  statement. 

If  the  deficiency  has  not  been  corrected,  a 
statement  of  dollar  value,  potential  level  of  risk  and  adverse 
publicity  which  could  result  if  the  weakness  continues  must  be 
attached.  Milestones  with  estimated  completion  dates  are  also 
required.  Any  weakness  or  potential  loss  of  more  than  five 
percent  of  current  resources  should  be  considered  for 
reporting  to  the  next  level  in  the  chain  of  command.  Criteria 
used  to  determine  the  materiality  of  weaknesses  are  provided 
in  Appendix  D.  [Ref.  23] 
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Appendix  E  is  a  selected  list  of  DON  material 
weaknesses  reported  to  the  Secretary  of  Defense  in  1989. 
c.  Regulations 

The  Federal  Managers'  Financial  Integrity  Act 
requires  the  head  of  each  agency  to  submit  annual  statements 
to  the  President  and  Congress  on  the  status  of  internal 
controls.  OMB  Circular  A-123  prescribes  government-wide 
policy  for  internal  control  systems  in  all  government 
operations . 

The  Under  Secretary  of  the  Navy  establishes 
program  policy  for  the  Department  of  the  Navy.  A  Review  and 
Oversight  Council  exists,  among  other  objectives,  to  ensure 
DON  weaknesses  are  promptly  corrected.  The  Naval  Audit 
Service,  and  Naval  Inspector  General  evaluate  compliance  with 
the  program. 

For  more  detailed  information  concerning  this 
program,  consult  SECNAVINST  5200. 35B  and  OPNAVINST  5200. 25B. 

3 .  Other  Command  Audits.  Reviews  and  Cash  Counts 

Although  called  audits,  these  are  actually  cash  count 
verifications  and  should  be  of  a  surprise,  irregular  nature 
occurring  not  less  than  once  each  quarter.  For  these  funds, 
managers  can  reduce  the  potential  for  fraud,  waste  and  abuse 
by  separating  duties  such  as  having  different  staff  receive, 
count,  record  and  deposit  the  money. 
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a.  Imprest  Fund 

The  imprest  fund  cashier  is  an  individual 
appointed  by  the  Commanding  Officer  for  the  purpose  of  making 
authorized  cash  payments  for  materials  and  services  and  is 
responsible  for  maintaining  custody  of  funds  and  filing 
periodic  vouchers  to  account  for  and  replenish  the  fund. 
Disbursing  personnel  cannot  be  cashiers.  [Ref.  25] 

The  NAVMILPERSCOMINST  7510. 2A  AND  NAVCOMPT  Manual 
Volume  4  provide  direction  for  the  imprest  fund  and  audit 
requirements . 

b.  Non-Appropriated  Funds 

These  funds  include  Morale,  Welfare  and  Recreation 
(MWR)  funds  and  Non-MWR  funds  such  as  the  chapel  funds,  and 
bachelor  quarters  funds. 

OPNAVINST  1730. IB  provides  guidance  for  use  of 
chapel  funds. 

NAVMILPERSCOMINST  7510. 2A  provides  guidance  for 
Bachelor  quarters  funds  and  Morale,  Welfare,  and  Recreation 
Funds . 

According  to  the  Director  for  MWR  Auditing,  Naval 
Military  Personnel  Command  (NMPC) ,  the  following  agencies  are 
available  for  the  Commanding  Officer's  use  for  auditing  the 
MWR  program. 

Internal  assets  such  as  audit  boards  or  qualified  staff. 
A  potential  problem  with  these  assets  is  the  lack  of 
independence  to  the  command.  Also,  most  commands  use 
collateral  duty  personnel  who  are  unfamiliar  with  the 


25 


accounting  system  and  may  not  perform  the  audit  with 
proficiency. 

Echelon  Two  Commanders  routinely  audit  the  program.  The 
Commanding  Officer  can  request  an  accelerated  review 
outside  the  normal  schedule. 

Naval  Investigative  Service  can  perform  special  investi¬ 
gations.  This  report  will  stay  within  the  command  if  no 
criminal  activity  is  suspected. 

Navy  Audit  Service  (at  cost  to  the  command)  or  NMPC 
Fiscal  Oversight  can  review  weaknesses  and  disclose 
compliance  with  directives. 

The  use  of  Certified  Public  Accounting  firms  (at  cost  to 
the  command)  require  advance  approval  from  the  Auditor 
General  of  the  Navy.  [Ref.  26] 

This  chapter  discussed  the  topics  of  management 

control  and  auditing  in  the  Navy.  The  next  chapter  will 

define  audits,  provide  audit  standards  and  discuss  the  audit 

process. 
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III.  AUDITS  AND  STANDARDS 


This  chapter  defines  audits,  provides  audit  standards  and 
discusses  the  audit  process. 


A.  AUDITS  DEFINED 

An  audit  is  the  process  by  which  an  independent  and 

competent  person  examines  a  sampling  of  the  actual  practices 

of  the  entity  under  study  and  compares  these  practices  to  the 

policies  and  directives  established  by  higher  authority  and 

generally  accepted  accounting  principles.  As  defined  by  DOD, 

...auditors  independently  and  objectively  shall  analyze, 
review,  and  evaluate  existing  procedures,  controls,  and 
performance  relating  to  organizations,  activities, 
programs  and  functions;  and  shall  present  conditions, 
conclusions,  and  recommendations  constructively  in  such  a 
way  as  to  stimulate  or  encourage  corrective  action.  [Ref. 
11 :p.  4] 

1 .  Financial  Audits 


A  financial  audit  determines 

. . .whether  the  financial  statements  of  an  audited  entity 
present  fairly  the  financial  position,  results  of 
operations,  and  cash  flows  or  changes  in  financial 
position  in  accordance  with  generally  accepted  accounting 
principles,  and  whether  the  entity  has  complied  with  laws 
and  regulations  for  those  transactions  and  events  that  may 
have  a  material  effect  on  the  financial  statements.  [Ref. 
l:p.  2-1] 

The  auditor's  conclusions  are  expressed  as  an  opinion 
of  the  entity's  performance  in  relation  to  policies  and 
principles.  Therefore,  the  opinion  cannot  attest  as  to 
whether  the  financial  statements  are  completely  accurate,  only 
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that  they  represent  the  actual  performance  of  the 
organization.  In  conducting  the  audit,  the  auditor  tests  the 
control  system  and  attempts  to  determine  whether  the  financial 
statements  are  an  accurate  portrayal  of  events,  whether  the 
organization  followed  the  generally  accepted  accounting 
procedures  and  general  policies  and  laws.  If  the  organization 
did  these  to  the  best  of  the  auditor's  knowledge  and  ability 
to  test  them,  then  the  opinion  will  report  that  the  statements 
are  fair. 

2 .  Performance  Audits 


Performance  audits  include  economy  and  efficiency  and 
program  audits.  Economy  and  efficiency  audits  include 
determining  whether  the  entity  is  acquiring,  protecting 
and  using  its  resources  economically  and  efficiently,  the 
causes  of  the  inefficiencies  or  uneconomical  practices  and 
whether  the  entity  has  complied  with  laws  and  regulations 
concerning  matters  of  economy  and  efficiency. 

Program  audits  include  determining  the  extent  to  which 
the  desired  results  or  benefits  established  by  the 
legislature  or  other  authorizing  body  are  being  achieved, 
the  effectiveness  of  organizations,  programs,  activities, 
or  functions,  and  whether  the  entity  has  complied  with 
laws  and  regulations  applicable  to  the  program.  General¬ 
ly,  at  the  completion  of  a  performance  audit  the  auditor 
does  not  express  an  opinion  on  the  overall  level  of 
performance.  Rather,  the  auditor  would  report  findings 
and  conclusions  on  the  extent  and  adequacy  of  performance 
and  on  specific  processes,  methods,  and  internal  controls 
that  can  be  made  more  efficient  or  effective.  If  poten¬ 
tial  for  improvement  is  found,  the  auditor  would  recommend 
appropriate  corrective  actions.  [Ref.  l:pp.  2-3 — 2-5] 


B.  ESTABLISHING  AUDITING  STANDARDS 

Three  standards  boards  enact  the  generally  accepted 
accounting  principles.  The  Governmental  Accounting  Standards 
Board  (GASB)  establishes  accounting  principles  and  financial 
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reporting  standards  for  state  and  local  government  entities. 
The  General  Accounting  Office  (GAO)  institutes  accounting 
principles  and  financial  reporting  standards  for  the  federal 
government.  The  Financial  Accounting  Standards  Board  (FASB) 
enacts  accounting  principles  for  nongovernment  entities. 
[Ref.  l:p.  2-1,  Footnote  1] 

All  auditors  who  conduct  audits  on  government  functions 
are  required  to  follow  the  Government  Auditing  Standards  as 
defined  in  the  GAO  Government  Auditing  Standards  booklet  (the 
yellow  book) .  These  standards  are  similar  to  those  developed 
by  the  American  Institute  of  Certified  Public  Accountants 
(AICPA)  for  nongovernment  auditors.  The  standards  are  divided 
between  general  and  specific,  field  work  standards.  Consult 
the  yellow  book  for  a  full  discussion  of  the  standards. 

1.  General  Standards 

Four  general  standards  detail  the  requirements  of 
government  auditors  and  nongovernment  auditors  performing 
audits  on  government  functions.  The  first  three  standards  are 
identical  to  the  standards  established  by  the  AICPA;  the  last 
standard  pertains  only  to  GAO  audits. 

The  standards  describe  the  independence  of  the  auditor 
and  the  independence  of  the  audit  organization;  the 
qualifications  of  the  audit  staff;  the  responsibility  of  due 
care;  and  the  presence  of  quality  control. 
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a.  Independence 

Independence  is  the  ability  of  the  auditor  to  be 
impartial,  and  to  be  viewed  as  impartial  by  cognizant  third 
parties,  in  collecting  and  analyzing  information  and  preparing 
an  opinion  relating  to  the  statements.  An  auditor  or  audit 
organization  can  be  viewed  as  independent  if  no  personal, 
external  or  organizational  impairments  exits.  [Ref.  l:pp.  3- 
8,  3-9] 

Personal  impairments  jeopardize  the  auditor's 
ability  to  make  an  impartial  examination  of  the  function. 
Such  impairments  can  include  a  prejudicial  attitude  to  the 
audited  function  or  members  of  that  organization?  political  or 
social  biases  due  to  loyalty  to  a  specific  organization? 
financial,  professional  or  personal  interest  in  the  audited 
organization?  and  prior  or  current  service  with  the  audited 
organization.  Policies  enable  the  auditor  and  audit 
organization  to  identify  any  personal  impairments  which  would 
mar  the  objectivity  of  the  auditor's  work  and  opinion.  [Ref. 
l:pp.  3-8,  3-9] 

External  impairments  reflect  on  the  ability  to 
make  a  free  and  unbiased  opinion.  They  result  from  factors 
outside  the  control  of  the  audit  organization  such  as  the 
level  of  funding  provided  to  the  audit  organization,  the  time 
provided  for  conducting  the  audit,  interference  from  the 
audited  agency  on  scope  of  the  audit  or  transactions  examined, 
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or  any  external  interference  which  impacts  the  objectives  of 
the  audit.  [Ref.  l:pp.  3-8,  3-9] 


Organizational  impairments  affect  the  audit 
organization  as  a  whole.  The  causes  of  these  can  be 
attributed  to  such  pressures  as  whether  the  organization 
reports  directly  to  the  director  of  the  audited  function, 
whether  its  personnel  are  hired,  promoted,  or  fired  on  merit 
or  political  coercion.  [Ref.  l:pp.  3-8,  3-9] 

b.  Qualifications  of  the  Audit  Staff 

The  combined  staff  should  have  the  professional 

qualifications  to  competently  perform  an  audit.  This  means 

that  the  audit  organization  as  a  whole  must  possess  these 

qualifications  not  necessarily  any  one  person. 

If  an  organization  employs  personnel,  or  hires  outside 
consultants,  with  acceptable  knowledge  and  skills  in  such 
areas  as  accounting,  statistics,  law,  engineering,  audit 
design  and  methodology,  automatic  data  processing,  public 
administration,  economics,  social  sciences,  and  actuarial 
science,  each  individual  staff  member  need  not  possess  all 
these  skills  and  knowledge.  [Ref.  l:pp.  3-1 — 3-2] 

In  order  for  the  audit  organization  to  maintain 
its  proficiency  and  technical  competence,  the  GAO  standards 
require  a  program  of  continuing  education  and  training  for  all 
auditors  assigned  to  the  organization  who  perform  audit 
activities  and  services.  [Ref.  l:pp.  3-1 — 3-2] 

c.  Due  Professional  Care 

The  auditor  performs  as  a  professional  in  all 
duties  related  to  the  audit.  This  includes  but  is  not  limited 
to  defining  the  scope  of  the  audit,  ensuring  the  audited 
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entity  understands  the  objectives  of  the  audit  prior  to 
performing  the  audit,  understanding  the  operations  to  be 
audited,  choosing  the  appropriate  methodology  and  tests  used 
based  on  materiality  or  significance  to  the  audit,  the 
completion  of  the  working  papers,  making  inquiries  concerning 
the  expertise  of  external  auditors  or  specialists  assisting  in 
the  audit,  rendering  a  sound  opinion,  and  determining  whether 
corrective  action  has  been  undertaken  from  previous  audits  if 
these  affect  the  current  audit.  Each  of  these  determines  the 
quality  of  the  final  product.  [Ref.  l:pp.  3-1 — 3-2] 

This  standard  does  not  mean  the  auditor  must  make 
a  perfect  judgment  or  is  infallible,  nor  does  it  imply  the 
auditor  assume  extensive  liability.  [Ref.  l:pp.  3-1 — 3-2] 
d.  Internal  Quality  Control 

This  applies  to  government  auditors  who  are 
required  to  follow  the  GAO  guidelines.  GAO  standards  require 
an 


...external  quality  control  review  at  least  every  three 
years  by  an  organization  not  affiliated  with  the  organiza¬ 
tion  being  reviewed.  The  external  quality  control  review 
program  should  determine  that  *-ho  o^r-i  ion '  s  internal 
quality  control  system  is  in  place  and  operating 
effectively  and  established  policies  and  procedures  and 
applicable  auditing  standards  are  being  followed  in  its 
audit  work.  [Ref.  l:p.  3-18] 

The  limits  of  an  internal  quality  control  system  depend  on  the 
size  of  the  firm,  the  nature  of  its  work  and  the  cost- 
benefit  considerations  given  to  a  quality  control  program. 
[Ref.  l:p.  3-18] 
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2 .  Specific  Standards 

This  section  describes  the  supplemental  field  work 
standards  for  financial  and  performance  audits. 

a.  Field  Work  Standards  For  Financial  Audits 

Financial  field  work  standards  have  been  developed 
by  the  AICPA.  These  are  supplemented  by  the  GAO  Government 
Auditing  Standards  to  assist  auditors  in  government  financial 
audits . 

(1)  Planning.  "Planning  should  include 
consideration  of  the  audit  requirements  of  all  levels  of 
government."  [Ref.  l:p.  4-1]  This  standard  requires  auditors 
to  determine  the  final  users  of  the  audit  and  plan  the  audit 
to  meet  their  legal  and  regulatory  requirements. 

(2)  Compliance  Tests.  Not  only  should  the 
auditor  test  compliance  with  the  laws,  but  also  test  how  not 
complying  with  the  laws  and  regulations  affects  the  financial 
statements  or  the  results  of  the  audit.  The  auditor  should  be 
predominately  concerned  with  those  laws  and  regulations  which 
directly  and  materially  affect  the  financial  statements. 
[Ref.  1 :p.  4-1] 

The  auditor  should  be  cognizant  of  areas 
susceptible  to  fraud  or  other  illegal  acts  and  design  audit 
tests  to  detect  those  which  could  have  a  material  affect  on 
the  financial  statements  or  the  report  of  a  financial  audit. 
As  part  of  the  general  standard  of  exercising  due  care,  the 
auditor  should  extend  the  scope  of  the  audit  when  evidence 
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indicates  possible  illegal  acts  or  terminate  the  audit 
completely,  turning  over  the  evidence  to  criminal 
investigators.  [Ref.  l:p.  4-1] 

(3)  Working  Papers.  These  provide  evidence  of 
the  audit  work  performed  and  the  basis  for  the  opinions 
expressed  in  the  report. 

(4)  Internal  Control  Structure.  The  auditor 
needs  a  sufficient  understanding  of  the  internal  control 
structure  in  order  to  plan  the  audit  and  associated  tests. 
With  financial  audits,  the  auditor  is  concerned  only  with 
those  controls  which  apply  to  the  financial  records  or  which 
the  auditor  uses  in  audit  tests.  [Ref.  l:p.  4-1] 

b.  Field  Work  Standards  For  Performance  Audits 

(1)  Planning.  Planning  includes  coordinating  the 
activities  with  other  agencies  which  may  be  involved  to 
prevent  double  work  and  to  centralize  aspects  of  the  work, 
such  as  the  final  report.  A  well-planned  audit  helps 
guarantee  the  costs  associated  with  the  audit  are  outweighed 
by  the  benefits  attained.  Initial  surveys  are  recommended  to 
adequately  plan  the  audit  scope.  [Ref.  l:pp.  6-6,  6-7] 

Audit  scope  is  the  boundary  of  the  audit 
including  the  audit  subject  and  performance  standards. 
Objectives  are  what  the  audit  attempts  to  accomplish  and 
should  be  clearly  and  concisely  documented.  Methodology 
includes  the  tests,  data  gathering  process  and  evidence 
collected  during  the  course  of  the  audit  to  show  that  the 
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objectives  and  scope  have  been  accomplished.  Performance 
standards  shou  d  be  reasonable,  relevant  and  attainable. 
[Ref.  l:pp.  6-6,  6-7] 

An  audit  program  is  developed  for  each  audit. 
The  audit  program  details  the  work  among  supervisors  and 
staff,  and  provides  the  methodology  and  procedures  to  be  used. 
As  a  minimum,  audit  programs  should  include: 

-  Introduction  and  background:  Information  should  be 
provided  about  the  legal  authority  for  the  audited  organi¬ 
zation,  program,  activity,  or  function;  its  history  and 
current  objectives;  its  principal  locations;  and  similar 
information  needed  by  the  auditor  to  understand  and  carry 
out  the  audit  program. 

-  Objectives  of  the  audit:  The  objectives  should  be 
clearly  stated. 

-  Scope  of  the  audit:  The  scope  should  be  clearly 
described. 

-  Audit  methods:  The  methodology  should  be  clearly 
described,  and  for  most  audits,  it  is  desirable  to  include 
suggested  steps  and  procedures,  and  sampling  plars  for  the 
auditors  to  follow. . . . 

-  Definition  of  terms:  Any  known  unique  terms  used  by 
the  audited  entity  should  be  defined  or  explained. 

-  Special  instruction: ... .This  section  of  the  program 
may  be  used  to  list  the  responsibilities  of  each  audit 
organization,  such  as  preparing  audit  programs,  conducting 
audit  work,  supervising  audit  work,  drafting  reports, 
handling  auditee  comments,  and  processing  the  final 
report. 

-  Report:  The  audit  program  should  set  forth  the 
general  format  (if  not  included  in  organization  audit 
policy  and  procedures)  to  be  followed  in  the  audit  report 
and  cite,  to  the  extent  possible,  the  types  of  information 
to  be  in  it.  [Ref.  l:pp.  6-6,  6-7] 

(2)  Supervision .  Supervision  varies  with  the 
staff  members'  level  of  experience  and  is  documented  in  the 
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working  papers.  This  includes  whether  the  objectives  were 
achieved,  the  audit  standards  and  audit  program  were  followed, 
and  whether  the  working  papers  substantiate  the  audit 
findings.  Providing  on-the-job  training  and  continuing 
education  are  also  included  in  this  standard.  [Ref.  l:p.  6-9] 

(3)  Compliance  Tests. 

An  assessment  is  to  be  made  of  compliance  with  applicable 
requirements  of  laws  and  regulations  when  necessary  to 
satisfy  the  audit  objectives. .. .Auditors  should  design  the 
audit  to  provide  reasonable  assurance  of  detecting  abuse 
or  illegal  acts  that  could  significantly  affect  the  audit 
objectives. .. .Auditors  should  be  alert  to  situations  or 
transactions  that  could  be  indicative  of  abuse  or  illegal 
acts.  [Ref.  l:p.  6-9] 

The  auditor  decides  which  laws  and  regulations  pertain  to  the 
audit  as  well  as  those  which  will  have  a  vital  influence  on 
the  objectives.  The  audited  entity  is  responsible  for 
providing  the  pertinent  laws  and  requirements  for  the  auditor. 

[Ref.  1 :p.  6-11] 

(4)  Assessment  of  Internal  Controls.  This  is 
required,  if  needed,  to  satisfy  the  audit  objectives.  The 
reasons  and  tests  used  to  evaluate  internal  controls  depend  on 
the  audit  objectives.  Not  all  audits  will  require  an 
assessment  of  the  controls.  [Ref.  l:p.  6-13]  GAO  Government 
Auditing  Standards  necessitate  examining  the  controls  if  the 
audit  objectives  require: 

testing  the  adequacy  of  particular  internal  controls. 

verifying  the  adequacy  of  the  process  for  carrying  out  a 

particular  mission  or  action. 

assessing  unsatisfactory  performance.  [Ref.  l:p.  6-13] 
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(5)  Evidence .  Evidence  has  four  categories: 
physical,  documentary,  testimonial  and  analytical. 

Physical  evidence  pertains  to  the  direct 
observation  or  inspection  by  the  auditor.  This  can  include 
observing  events  such  as  counting  inventory;  inspecting 
charts,  graphs,  maps,  buildings  etc.,  or  other  physical 
documentation  of  property;  and  observing  people  in  action. 
This  type  of  evidence  is  more  reliable  and  valid  than  that 
which  is  obtained  indirectly.  [Ref.  l:pp.  6-16,  6-17] 

Documentary  evidence  relates  to  the  files  of 
the  organization  reflecting  performance.  These  are  the  memos, 
letters,  accounting  records,  etc.  The  original  documents  are 
considered  more  reliable  than  copies.  [Ref.  l:pp.  6-16,  6-17] 

Testimonial  evidence  comes  from  interviews 
and  correspondence  written  directly  to  the  auditing  service. 
If  the  evidence  is  significant  to  the  audit,  the  auditor 
should  also  collect  supporting  information  regarding  the 
statements  and  the  reliability  of  the  source.  The  testimony 
can  be  considered  valid  and  reliable  when  the  person  can  speak 
without  reprisals.  [Ref.  l:pp.  6-16,  6-17] 

Analytical  evidence  applies  to  the 
calculations,  logic,  and  correlation  of  the  information 
received.  [Ref.  l:pp.  6-16,  6-17] 

Once  the  auditor  has  the  evidence,  it  must  be 
tested  for  sufficiency,  relevance  and  competence. 
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-  Sufficiency  is  the  presence  of  enough  factual  and 
convincing  evidence  to  support  the  auditors'  findings, 
conclusions,  and  any  recommendations.  Determining  the 
sufficiency  of  evidence  requires  judgment.  When 
appropriate,  statistical  methods  may  be  used  to  establish 
sufficiency. 

-  Relevance  refers  to  the  relationship  of  evidence  to 
its  use.  The  information  used  to  prove  or  disprove  an 
issue  is  relevant  if  it  has  a  logical,  sensible  relation¬ 
ship  to  that  issue.  Information  that  does  not  is  irrele¬ 
vant  and  therefore  should  not  be  included  as  evidence. 

-  To  be  competent,  evidence  should  be  valid  and 
reliable.  In  evaluating  the  competence  of  evidence,  the 
auditors  should  carefully  consider  whether  reasons  exist 
to  doubt  its  validity  or  completeness.  If  so,  the 
auditors  should  obtain  additional  evidence  or  reflect  the 
situation  in  the  report.  [Ref.  l:p.  6-17] 

The  auditor  can  surmise  the  evidence  is  competent  if  it  comes 

from  a  source  independent  of  the  audited  entity;  or  if  the 

internal  control  structure  is  strong.  [Ref.  l:p.  6-17] 


C.  AUDIT  PROCESS 

Four  stages  occur  in  most  audits,  whether  they  are 
performed  by  the  in-house  auditors  or  audit  agencies: 
planning,  survey,  verification  and  reporting. 

1 •  Planning  Stage 

Preliminary  research  and  preparation  for  an  audit 
could  best  describe  this  phase.  To  control  costs  and  to 
ensure  an  audit  which  will  assist  management  effectively,  an 
audit  plan  is  developed.  Limited  value  is  attributed  to  even 
superbly  conducted  audits  which  provide  meager  or  no  benefits 
to  management.  In  addition,  audits  which  are  broadly  scoped 
cannot  control  costs  effectively  thereby  diminishing  the 
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results  of  the  audit  report.  With  increasing  attention 
focused  on  government  spending,  it  behooves  the  audit  agencies 
to  develop  sound  audit  plans  which  can  justify  when  and  why 
certain  areas  are  planned  and  audited  or  not  planned  and  not 
audited.  [Ref.  27:Ch.  5,  p.  3] 
a.  Justification 

The  DOD  Internal  Audit  Manual  provides  the 
following  causes  for  justifying  and  prioritizing  audits: 

1.  Sensitivity.  The  sensitivity  of  a  program  or  system 

to  the  mission  of  an  organization  and  the  importance  of 
that  mission  to  the  overall  mission  of  its  parent 
organization  are  important  considerations.  Other 

considerations  include  whether  an  area  is  of  high  interest 
to  the  head  of  the  Department  or  organization  or  whether 
poor  performance  in  an  area  could  cause  severe 
embarrassment  to  the  Department  or  adversely  impact  on  its 
relations  with  Congress. 

2.  Risk.  The  adequacy  of  internal  control  systems  and 
the  vulnerability  of  an  area  to  fraud,  waste,  abuse  or 
mismanagement  is  the  major  consideration  in  this  area. 
Also,  the  newness  of,  or  major  changes  in,  programs  and 
systems  could  increase  the  risks. 

3.  Audit  Experience.  Give  a  higher  rating  to  an  audit 
area  that  has  a  history  of  major  deficiencies  than  to  an 
area  that  has  experienced  only  minor  deficiencies  in  the 
past.  Be  sure  to  consider  the  results  of  other  evalua¬ 
tions  such  as  inspections,  investigations  and  program 
reviews,  along  with  the  results  of  the  most  recent  reviews 
by  the  audit  activity,  other  DOD  audit  organizations,  U.S. 
General  Accounting  Office  (GAO) ,  and  commercial  firms 
performing  audit  work  on  a  contractual  basis. 

4.  Financial  Impact.  Identify  the  current  or  potential 
dollars  involved  in  the  programs,  system  or  function. 
This  can  be  measured  in  various  ways  such  as  value  of 
assets  or  amount  of  funding. 

5.  Time  Since  Last  Audit.  Consider  the  date  of  the  last 
audit  or  comprehensive  inspection  and  assign  higher 
ratings  to  those  with  longer  elapsed  times  since  the  last 
audit  or  comprehensive  inspection. 
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6.  Management  Request.  Assign  additional  rating  points 

when  management  requests  an  audit  of  the  area.  [Ref. 

27:Ch.  5,  pp.  5-6] 

b.  Audit  Plan 

Planning  and  conducting  the  audit  is  the  auditor's 
responsibility.  The  audit  plan  contains: 

-  the  audit  objectives  and  scope. 

the  background  of  the  proposed  activity. 

-  written  communication  with  all  interested  parties 
including  the  activity  to  be  audited. 

resources  required  to  perform  the  audit  adequately. 

-  on-site  surveys  planned  to  develop  familiarity  of  the 
program,  to  identify  areas  to  emphasize,  and  to  invite 
comments  from  the  activity. 

approval  of  the  work  plan. 

coordinating  the  plan  with  other  audit  and  review 
agencies  to  ensure  similar  audits  are  not  planned  or 
currently  running.  [Ref.  27:Ch.  2,  p.  8] 

2 .  Survey  Stage 

The  survey  stage  is  the  refinement  stage.  For  the 

Naval  Audit  Service,  this  phase  encompasses  approximately  30 

percent  of  the  total  audit  time.  [Ref.  28]  During  this 

phase,  the  audit  team  determines  whether  sufficient  evidence 

exists  to  perform  an  audit  and  attain  monetary  benefits  in 

excess  of  costs.  Approval  to  continue  with  the  audit  process 

is  assigned  to  senior  management  based  on  the  reports  from  the 

field  auditors.  [Ref.  27:Ch.  8,  p.  4]  This  phase  requires: 

familiarity  with  the  program,  planned  area,  and  its 
policies  and  procedures.  It  provides  auditors  the 
opportunity  to  interview  management  for  suggestions  and 
comments,  to  identify  areas  of  weakness  or  corrective 
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actions  taken  from  previous  inspections  or  audits,  and 
to  identify  potentially  significant  findings  for 
further  study  during  the  verification  phase.  This 
phase  also  develops  or  refines  audit  objectives  and  the 
scope  of  the  work  including  site  selection.  [Ref. 
2 7 : Ch .  8,  p.  4] 

the  decision  to  proceed  with  the  audit. 

The  audit  program  is  then  developed.  The  program  *111 
include  the  revised  or  established  audit  objectives;  special 
instructions  and  definition  of  terms;  background  of  the 
function  to  be  audited  including  but  not  limited  to  location, 
mission,  policies  and  procedures,  and  noted  areas  of 
deficiencies  in  the  control  program;  purpose  and  scope  of  the 
audit  as  well  as  methodology,  and  the  format  and  content  of 
the  report.  [Ref.  27:Ch.  8,  p.  4]  If  the  audit  program  is 
effective,  standardized  procedures  will  then  exist  for 
multilocation  audits.  [Ref.  27:Ch.  8,  p.  4] 

3 .  Verification  Stage 

The  actual  audit  field  work  occurs  during  this  phase. 
The  audit  team  provides  an  entrance  letter  to  the  component 
head,  detailing  the  objectives  and  scope  of  audit  and  the 
period  of  time  which  the  audit  will  cover.  This  letter 
provides  ample  notification  for  the  entity  to  prepare  for  the 
audit.  The  auditors  will  request  an  initial  interview  with 
the  command  in  which  they  will  address  their  objectives  and 
any  concerns  the  command  may  have,  including  noted  weaknesses 
which  are  being  corrected,  prior  to  beginning  the  actual  work. 
No  entrance  letter  is  sent  for  cash  counts  or  similar  audits 
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where  surprise  is  essential  to  the  audit.  For  all  audits, 
management  will  be  advised  when  objectives  are  modified  and 
when  the  audit  progresses  through  each  stage. 

During  this  phase,  the  auditors  collect  the  evidence 
needed  to  accomplish  the  audit  objectives  and  to  develop 
conclusions  and  opinions  concerning  the  audited  entity.  Some 
of  the  evidence  collected  includes  investigating  prior  audit 
recommendations  and  testing  for  corrective  action.  The  prior 
audits  need  not  have  been  performed  by  the  same  agency.  Any 
previous  audit  is  eligible.  [Ref.  27:Ch.  8,  pp.  5-8] 

The  auditors  are  responsible  for  developing  their 
potential  findings  and  recommendations  as  early  in  the  audit 
as  possible  and  discussing  these  with  the  audited  entity's 
officials,  before  they  are  in  the  formal  draft.  The  findings 
must  relate  to  the  objectives.  If  management  takes  corrective 
actions  on  the  potential  findings,  this  action  will  be 
reflected  in  the  report  as  well  as  any  corrective  actions 
taken  prior  to  the  audit.  [Ref.  27:Ch.  8,  pp.  5-8] 

A  draft  report  will  be  presented  to  the  activity  prior 
to  the  end  of  the  audit  or  within  60  days  of  completion  of  the 
field  work.  This  report  clarifies  any  discussions  with 
management,  provides  management  the  opportunity  to  refute 
claims  of  benefits  associated  with  the  findings  and  in  the 
process  reduces  the  possibility  that  management  will  reject 
the  report.  [Ref.  27:Ch.  8,  pp.  5-8] 
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The  exit  conference  is  management's  final  occasion  to 
discuss  disputed  matters  with  the  auditors  before  the  formal 
draft  is  written.  If  this  conference  occurs  before  management 
has  a  chance  to  see  the  draft  report,  another  conference  will 
be  offered,  if  desired.  [Ref.  27:Ch.  8,  pp.  5-8] 

The  final  step  in  this  process  is  the  post-audit 
critique  which  is  designed  for  management  to  provide  feedback 
for  improving  audits  of  the  type  just  performed.  [Ref.  27:Ch. 

8,  p.  8] 


4 .  Reporting  Phase 

The  audit  report  is  the  formal  written  document  which 
describes  the  results  of  the  audit  process.  Included  in  this 
document  are  the  auditors'  opinions  and  recommendations  for 
improving  material  deficiencies.  All  audit  reports  follow  the 
standards  established  by  the  AICPA  and  the  GAO  Government 
Auditing  Standards. 

a.  Financial  Audit  Reporting  Standards 

The  first  four  standards  for  reports  of  financial 

audits  and  financial  related  audits  require  a  statement  that: 

the  audit  was  made  following  generally  accepted  govern¬ 
ment  auditing  standards  (GAGAS) .  This  refers  to  the 
standards  described  in  the  yellow  book.  [Ref.  27 :p. 
12-2] 

a  test  was  conducted  for  compliance  with  laws  and 
regulations.  The  compliance  statement  will  be  in  the 
form  of  a  positive  or  negative  assurance.  A  positive 
assurance  indicates  the  test  was  performed  and  there 
appears  to  be  compliance  with  the  laws.  A  negative 
assurance  indicates  that  nothing  appears  to  indicate 
noncompliance  in  the  items  not  tested.  This  statement 
on  compliance  will  indicate  whether  illegal  activities 
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identified  through  the  audit  could  result  in  criminal 
prosecution.  A  noncompliance  statement  will  be  issued 
if  necessary.  [Ref.  27:p.  12-2] 

concerns  the  auditors'  assessment  of  the  internal 
control  structure.  This  statement  will  detail  the 
scope  of  the  work  involved  to  garner  an  understanding 
of  the  control  environment,  tests  of  the  controls  and 
the  report  of  the  condition  of  the  controls. 

An  assessment  need  not  be  made  but  must  be 
reported,  if: 

a.  uhe  size  of  the  audited  organization  is  small, 

b.  the  control  structure  is  so  weak  that  the  auditor 
had  to  rely  on  other  tests, 

c.  it  was  more  efficient  to  conduct  other  tests,  or 
the  audit  objectives  did  not  require  an  evaluation 
of  the  internal  controls.  [Ref.  27 :p.  12-2] 

some  information  which  forms  the  auditors'  opinions  may 
be  prohibited  by  law  from  disclosure.  If  this  is  the 
case,  the  auditor  will  describe  the  nature  of  the  work 
and  the  basis  for  the  nondisclosure  in  the  audit 
report.  [Ref.  27:p.  12-2] 

The  fifth  standard  covers  distribution  and 
timeliness  of  the  audit  report.  Timeliness,  for  DOD,  means 
within  120  days  following  the  draft  report.  [Ref.  27 :p.  12-2] 
Generally,  unless  the  report  is  classified  for  security  or 
ethical  reasons,  it  is  made  available  to  all  interested 
parties  for  inspection. 

b.  Performance  Audits 

Performance  audit  reports  will  include  the 
statements  as  described  above  on  compliance  with  GAGAS, 
assessment  of  internal  controls,  compliance  with  laws  and 
regulations,  disclosure  and  distribution  requirements. 
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In  addition  the  report  will  have  a  statement 
describing  the  audit  scope,  objectives  and  methodology.  Audit 
findings  and  conclusions  should  be  relevant,  competent  and 
sufficient.  The  findings  and  conclusions  will  be  clearly 
stated.  Any  background  information  for  which  an  interested 
third  party  may  need  to  understand  the  report  will  also  be 
included.  [Ref.  l:p.  7-15] 

Where  weaknesses  and  deficiencies  are  noted,  the 
auditor  will  provide  the  cause  of  the  problem  identified  and 
supporting  evidence.  Beneficial  and  practical  recommenda¬ 
tions  when  required  by  the  audit  objectives  will  be  made  if 
corrective  action  will  significantly  affect  the  organiza-tion. 
Any  uncorrected  actions  from  previous  audits  will  be  reported. 
Auditors  are  advised  to  address  their  specific  recommendations 
in  a  constructive,  performance-directed  manner  to  those 
officials  capable  of  taking  action.  [Ref.  l:p.  7-15] 

Performance  audit  reports  will  p_  ovide  for 
appropriate  remarks  by  accountable  officials  on  action  taken 
or  contemplated  concerning  the  findings  and  conclusions.  The 
auditor  will  normally  request  these  remarks  in  writing  to 
avoid  possible  misinterpretation.  [Ref.  l:p.  7-15] 

The  report  will  note  if  the  audit  uncovered  any 
management  achievements,  especially  if  these  applied  to  other 
areas  of  the  audited  entity,  "inclusion  of  such 
accomplishments  may  lead  to  improved  performance  by  other 
government  organizations  that  read  the  report."  [Ref.  l:p. 
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7-11]  Any  areas  requiring  further  study  but  not  associated 
with  the  audit  objectives  under  examination,  will  also  be 
noted  in  the  report.  [Ref.  l:p.  7-15] 

The  performance  audit  report  will  be  "complete, 
accurate,  objective,  and  convincing,  and  be  as  clear  and 
concise  as  the  subject  matter  permits."  [Ref.  l:p.  7-12] 
Complete  refers  to  the  information  provided,  the  perspective 
of  evidence  to  the  findings,  and  if  required,  supporting 
documentation  for  the  reader  to  correctly  understand  the 
organization's  performance.  An  accurate  portrayal  refers  to 
ethical  and  professional  work.  An  audit  agency  maintains 
integrity  in  its  working  papers  if  evidence  is  relevant  and 
competent  to  the  audit  scope,  objectives  and  methodology. 
[Ref.  1 :p.  7-15] 

Objectivity  is  the  impartial  manner  in  which  the 
audit  is  conducted,  the  facts  presented,  and  the  report 
written.  A  professional  report  will  keep  findings  and 
conclusions  in  perspective.  Behavior  modification  is  always 
the  reason  for  the  recommendations.  Therefore,  the  auditor 
will  address  the  report  in  a  constructive  manner  so  as  to  be 
helpful.  [Ref.  l:p.  7-15] 

Convincing,  clear  and  concise  requires  the  auditor 
to  present  the  report  in  a  manner  which  is  easy  to  read,  whose 
conclusions  follow  logically  from  the  facts  and  audit 
objectives,  providing  any  necessary  supporting  documents  such 
as  charts  or  graphs  which  will  make  it  easier  to  understand. 
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The  report  will  be  long  enough  to  cover  the  audit  without 
being  redundant?  a  complete,  concise  report  will  receive 
greater  attention.  [Ref.  l:p.  7-15] 
c.  Follow-up 

The  auditors  check  for  corrective  actions  on  known 
findings  and  recommendations  from  previous  audits  which  could 
affect  the  findings  of  the  current  audit.  During  this  check, 
they  also  ascertain  whether  optimum  benefits  were  attained  in 
a  timely  manner.  [Ref.  l:p.  7-15] 

Follow-up  for  auditors  also  occurs  after  their 
report  is  issued.  They  verify  management's  responses  are  made 
within  60  days  of  the  draft  report  or  60  days  following 
release  of  the  final  report.  If  a  deficiency  requires 
immediate  action,  the  timeframe  for  responses  will  be 
indicated  in  the  report.  The  second  part  of  follow-up 
requires  the  auditor  to  review  the  management's  responses 
according  to  DOD  directives.  Management  is  compelled  to 
concur  or  not  concur  with  each  audit  finding,  recommendation 
and  monetary  benefit.  The  audited  entity  may  indicate  whether 
alternative  action  is  more  appropriate  and  provide  their 
proposal.  Management  is  also  compelled  to  provide  any 
corrective  action  taken  and  a  plan  of  action  on  those  findings 
and  recommendations  where  corrective  action  has  not  been 
taken.  The  plan  of  action  will  also  indicate  estimated  dates 
of  completion  and  monetary  benefits  anticipated.  [Ref.  l:p. 
7-15] 
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Specific  guidelines  for  resolving  disputes  are 
provided  within  DOD  Directive  7650.3. 

This  chapter  defined  audits,  provided  audit 
standards  and  discussed  the  audit  process.  The  next  chapter 
will  discuss  practical  suggestions  for  managers  to  prepare  for 
and  participate  in  audits  or  reviews. 
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IV.  PRACTICAL  GUIDELINES  FOR  A  SUCCESSFUL  AUDIT 


This  chapter  discusses  practical  suggestions  for  managers 
to  prepare  for  and  participate  in  audits  or  reviews. 


A.  PREPARING  FOR  AN  AUDIT  OR  INSPECTION 

Once  notified,  the  following  steps  are  recommended. 

Usually  the  manager  will  have  several  months  notice  of  a 

pending  audit  or  inspection.  The  manager  should: 

Review  the  areas  of  special  interest  issued  in  the  audit 
plan,  and  understand  the  objectives  and  scope  of  the 
audit  or  inspection.  Will  it  be  an  activity  level 
compliance  audit  or  will  its  focus  be  narrowed  to  a 
specific  program?  If  it  will  be  a  multi-location  audit, 
the  manager  will  require  more  specific  preparation. 

Review  prior  inspection  and  audit  findings  for  areas  of 
potential  weaknesses,  since  auditors  look  at  results  and 
recommendations  from  previous  audits.  If  these  have  been 
reported  corrected  but  the  deficiencies  still  exist, 
managers  must  take  immediate  action  to  correct  the 
situation. 

Prioritize  the  discrepancies  requiring  corrective 
action  according  to  the  level  of  risk  and  vulnerability 
to  tne  mission  of  the  command.  Two  audit  findings  are 
considered  the  worst  kind:  repeat  audit  findings  when 
corrective  action  was  reported  earlier,  and  new  audit 
findings  identifying  a  weakness  of  which  the  manager  was 
unaware . 

Perform  a  mini-audit,  examination  or  review  on  the 
function.  Is  there  compliance  with  the  required 
standards,  directives,  etc.?  If  the  Management  Control 
Review  has  been  conducted  correctly,  there  should  be  few, 
if  any,  surprises. 
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B.  PARTICIPATING  IN  AN  AUDIT 


1.  Professionalism  and  Cooperation 

Cooperation  in  attitude  is  extremely  important.  The 
manager  should  assume  a  professional  stance. 

Be  helpful.  Assist  the  auditor  with  access  to 
requested  information.  However,  limit  access  to  the  requested 
information  only,  so  weaknesses  can  be  attributed  exclusively 
to  that  file. 

Provide  status  on  apparent  deficiencies  and  any 
corrective  action  which  has  been  taken.  If  the  problem  is 
obvious,  the  auditor  will  find  it  anyway.  Ask  for  advice  on 
how  to  correct  problem  areas,  especially  during  survey  audits. 
The  auditor's  job  is  to  assess  the  function  and  make 
corrective  recommendations. 

The  Naval  Audit  Service  indicates  some  managers  have 
been  known  to  conceal  vital  information  to  an  audit  only  to 
turn  it  over  during  the  exit  conference.  [Ref.  28]  Managers 
maintain  their  credibility  with  the  auditors  if  they  are 
honest  and  are  not  concealing  information.  When  the  manager 
loses  credibility,  the  auditor  relies  on  evidence  obtained 
elsewhere. 

Provide  an  area  for  the  auditor  to  work  uninterrupted. 
Since  the  auditor  is  unfamiliar  with  the  physical 
organization,  the  manager  should  provide  a  layout  of  the 
building. 
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Assist  in  scheduling  meetings  and  interviews  with  key 
personnel.  This  also  requires  the  manager  to  have  key 
personnel  available  during  the  audit,  scheduling  leave  and 
travel  appropriately. 

Ensure  the  staff  has  been  trained  to  comply  with 
directives  and  instructions  so  the  auditors  receive  the  same 
information  from  all.  Other  ways  to  participate  include 
asking  questions  of  the  auditors  to  clarify  information  or  to 
understand  the  work  and  tests  performed.  Keep  the  chain  of 
command  informed  of  the  progress  and  any  important  develop¬ 
ments  or  findings  which  could  reflect  adversely  on  the 
command . 

2 .  Auditee's  Bill  of  Rights 

An  audited  organization  has  certain  rights  during  an 

audit. 

a.  Right  1 

To  know  the  scope,  schedule  and  objectives  of  the 
audit  or  any  changes  to  these.  The  auditor  is  required  to 
provide  this  information  at  the  entrance  interview. 

b.  Right  2 

To  conduct  its  work  with  minimal  interference. 
The  audited  entity  should  provide  a  point  of  contact  if  the 
auditor  requires  assistance  outside  the  interview  schedule. 

c.  Right  3 

To  ask  questions  of  the  auditor  or  request 
clarifying  information  pertaining  to  the  audit  at  any  time. 
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The  organization  has  the  right  to  understand  the  audit  process 
including  the  methodology,  tests  and  findings. 

d.  Right  4 

To  read  the  report  before  final  release.  This  is 
extremely  important.  If  there  are  disagreements,  the  manager 
should  make  them  known.  Indicate  concurrence  or  non¬ 
concurrence  to  each  finding,  in  writing.  Major  claimants  have 
been  known  to  mark  budgets  based  on  a  manager's  concurrence 
with  the  findings.  If  the  manager  does  not  concur,  provide 
supporting  evidence  for  the  non-concurrence.  This  is  the 
manager's  last  opportunity  to  question  the  findings  and  tests. 
[Ref.  29] 

3 .  Audit  Follow-up 

Design  a  tickler  system  to  track  each  finding  until 
corrective  action  has  been  taken  and  verified.  This  tickler 
system  furnishes  information  which  indicates  the 
organization's  position  on  the  findings,  corrective  action 
taken  and  whether  the  actions  corrected  the  noted 
deficiencies.  It  also  indicates  monetary  benefits  achieved 
and  how  these  correspond  to  the  audit  report.  Finally,  the 
tickler  file  provides  a  plan  of  action  including  dates  for 
corrective  action  and  completion  of  those  areas  not  readily 
corrected.  The  tickler  file  remains  open  until  the  corrective 
actions  have  been  taken  and  confirmed  or  verified. 

The  tickler  file  should  be  made  available  for  all 
interested  entities  to  perform  new  audits,  reviews,  etc., 
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based  on  the  status  of  the  audit  report.  All  documentation 
remains  in  the  follow-up  files  for  further  reviews.  [Ref. 
30:p.  6] 

C.  USING  AUDIT  AND  REVIEW  ASSETS  EFFECTIVELY 

Judicious  use  of  internal  assets,  such  as  former  internal 
review  personnel,  accountants,  or  management  analysts, 
promotes  better  management.  When  you  ask  functional  leaders 
to  report  on  their  areas,  you  get  what  you  inspect.  [Ref.  31] 
Managers  are  reluctant  to  report  weaknesses  for  which  they 
cannot  correct  promptly. 

Internal  assets,  audits  and  reviews  keep  people  honest. 
If  they  know  they  will  be  inspected,  they  are  more  likely  to 
follow  established  guidelines. 

Internal  assets  can  also  investigate  Commanding  Officer's 
hot-line  issues.  If  these  issues  are  of  significant  concern 
or  dollar  amounts,  the  Commanding  Officer  can  address  them 
further  in  economy  and  efficiency  reviews,  or  audits. 

Whether  to  perform  economy  and  efficiency  reviews  on  a 
periodic  basis  or  a'  the  beginning/end  of  tours  is  a 
management  decision.  Some  prefer  the  periodic  basis  which 
provides  the  manager  the  opportunity  to  correct  the  problems 
before  detaching.  They  also  feel  that  since  other  employees 
are  still  in  that  functional  organization,  new  standards  can 
be  developed  at  any  time.  Others  prefer  the  entrance/exit 
review  as  a  measure  of  the  efficiency  and  effectiveness  of  the 
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outgoing  manager,  and  for  establishing  a  new  set  of  standards 
for  the  new  manager  to  follow. 

D.  MANAGEMENT  CONCERNS 

Most  commands  report  the  discrepancies  noted  in  audits  are 
the  result  of  not  having  adequate  numbers  of  staff  or  time  to 
do  everything  which  is  required.  Fraud,  waste,  abuse  or 
mismanagement  are  not  the  typical  culprits.  The  manager  makes 
the  decision  by  default  on  which  requirements  are  more 
important  and  which  can  be  relegated  to  second  place  until 
time  permits.  Most  interviewees  said  they  have  good  people 
doing  a  good  job  the  way  they  were  trained.  The  training  and 
time  to  perform  the  job  could  be  improved. 

A  second  concern  affects  the  topics  audited.  The  managers 
feel  the  topics  are  not  necessarily  the  big  dollar  items,  such 
as  those  which  have  the  largest  budgets  but  are  more  often  the 
result  of  political  and  media  events.  Often,  the  small  funds, 
such  as  Morale,  Welfare  and  Recreation  (MWR)  funds  and  chapel 
funds  receive  the  greatest  attention  due  to  their  high 
visibility  and  risk  status  since  they  handle  cash 
transactions.  According  to  one  interviewee,  five  percent  of 
the  audits  are  spent  on  a  function  which  uses  60  percent  of 
the  budget,  and  30  to  40  percent  of  the  audit  time  is  spent  on 
chapel  funds  and  MWR.  Additionally,  directives  are  sometimes 
behind  the  times,  as  in  MWR  requirements.  However,  these 
outdated  directives  are  the  only  source  for  auditors  to  rely 


54 


upon  when  checking  compliance.  [Ref.  31]  Other  interviews 
provided  similar  information. 

E.  CONCLUSION 

Taxpayers  are  becoming  increasingly  concerned  with  how  the 
government  spends  its  money,  particularly  in  defense-related 
areas.  With  constant  discussions  concerning  the  spiraling 
budget  deficit  and  resultant  interest  payments,  the  media  and 
taxpayers  are  demanding  closer  scrutiny  of  the  budget  and  how 
government  funds  are  spent. 

Congress  attempts  to  control  wasteful  spending  through 
budget  restraints.  For  instance,  audit  reports  generally 
recommend  various  savings  and  benefits.  Theoretically,  if  the 
recommendations  are  enacted  by  the  auditee,  budget  savings 
should  accrue.  However,  if  these  recommendations  are  not 
implemented.  Congress  can  restrict  the  budget  to  the  amount  of 
the  projected  savings  under  the  assumption  that  an 
efficiently-managed  program  would  require  less  funding. 
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APPENDIX  A 


COMMON/RECURRING  DISCREPANCIES  FOUND 
DURING  COMMAND  INSPECTIONS 


This  is  an  abbreviated  list  of  recurring  items  discovered 

during  command  inspections  by  major  claimants. 

Failure  to  maintain  an  active  energy  conservation  and 
awareness  program  to  meet  CNO  energy  management 
objectives  by  not  taking  advantage  of  energy  reduction 
projects,  conducting  quarterly  energy  conservation 
committee  meetings,  developing  an  energy  improvement  plan 
and  instituting  an  awareness  program. 

Failure  to  implement  a  Military  EEO  Program  and  ensure 
that  Navy  Rights  and  Responsibilities  Workshops  are 
conducted. 

Failure  to  develop  adequate  performance  standards  and 
elements  in  that  they  are  too  vague  or  general,  unrelated 
to  duties  described  in  position  descriptions,  not 
measurable,  or  address  conduct  rather  that  performance. 

Failure  to  implement  an  effective  Internal  Controls 
Program  wherein  reviews  are  properly  documented. 

Failure  to  adequately  test  internal  controls  while 
conducting  Management  Control  Reviews  (MCRs) . 

Failure  to  establish  adequate  controls  for  monitoring  the 
use  of  overtime. 

Failure  to  comply  with  Occupational  Safety  and  Health 
training  requirements  for  all  categories  of  personnel. 

Failure  to  establish  a  strict  key  and  lock  control 
program. 

Failure  to  develop  and  publish  a  comprehensive  Physical 
Security  Plan. 

Failure  to  develop  and/or  maintain  an  updated  Oil  Spill 
Prevention  Control  and  Countermeasure  Plan  for  fuel 
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storage  facilities  to  identify  potential  sources  of 
petroleum  spills. 

Failure  to  initiate  proper  tracer  action  on  inbound 
household  goods  shipments  which  do  not  arrive  by  the 
required  delivery  date  in  order  to  determine  current 
location,  status,  and  new  estimated  time  of  arrival. 

Failure  to  establish  adequate  controls  for  disposal  proof 
of  shipment/proof  of  delivery  processing  in  order  to 
account  for  transfer  of  shipments  to  the  Defense 
Reutilization  and  Marketing  Office  (DRMO) . 

Failure  to  process  interfund  billings  in  a  timely 
manner.  [Ref.  32] 
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APPENDIX  B 


NAVAL  AUDIT  SERVICE 

The  Naval  Audit  Service  is  divided  into  four  directorates: 
Management  Resources  Directorate;  Plans  and  Policy 
Directorate;  Audit  Operations  Directorate;  and  Management 
Consulting  Directorate.  Audit  coverage  is  divided  into  four 
regions:  Western,  Northeast,  Capital  and  Southeast.  In 

addition  to  the  Navy  Audit  Service  Headquarters  and  the 
Regional  Headquarters,  auditors  can  be  found  in  the  following 
locations: 

-  SYSTEMS  COMMANDS  AND  HEADQUARTERS  ACTIVITIES. 

-  INVENTORY  CONTROL  POINTS. 

-  SHIPYARDS . 

-  AVIATION  DEPOTS. 

-  SUPPLY  CENTERS . 

-  FINANCE  CENTERS . 

-  MARINE  CORPS  BASES. 

-  RDT&E/ENGINEERING  ACTIVITIES. 

With  a  FY-1990  budget  of  $28.8  million,  554  civilian 
personnel  (primarily  in  the  GS/GM-511  Auditor  series) , 
generated  about  700,000  direct  audit  hours. 

The  Naval  Audit  Service  was  heavily  criticized  by  GAO  and 
DOD  IG  in  1986-7  for  recommending  $6  million  in  potential 
benefits  while  spending  $26  million  a. id  lacking  documented 
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supervision  and  quality  control.  Designating  military 

officers  as  deputy  auditor  general  and  regional  office 

directors  created  the  perception  of  reduced  audit  independence 

and  a  potential  conflict  of  interest  with  future  supervisors. 

Senior  Navy  Auditor  concerns  centered  on  the  considerable 
amount  of  resources  expended  to  complete  audit  guides  and 
prepare  workpapers  for  areas  which  contained  little  or  no 
audit  potential.  The  Navy  Auditor  General  dedicated  29 
percent  of  available  audit  hours  in  FY86  to  single-activity, 
compliance  audits.  [Ref.  3:p.  12-14] 

As  a  result  of  the  GAO  findings,  the  Naval  Audit  Service 
restructured  itself,  providing  extensive  supervision  and 
quality  control.  Military  directors  were  replaced  with 
SES/GM-15  civilian  directors  to  counter  possible  conflict  of 
interest  and  audit  independence  concerns. 

Standardized  audit  programs  were  discontinued  and  a  unique 
audit  program  was  designed  for  each  audit.  Mission  effective¬ 
ness  and  efficiency  replaced  compliance  as  the  primary  audit 
objective.  The  by-products  could  be  savings  and  readiness. 
Savings  are  defined  as:  1)  recurring  (annual  recurring)  or 
non-recurring  (one  time  savings,  such  as  when  the  program  is 
canceled),  and  2)  collections  from  overpayment.  [Ref.  18] 

The  Naval  Audit  Service  also  developed  an  audit-by¬ 
objectives  approach.  This  management  technique  forces 
auditors  to  attend  to  the  objectives  throughout  the  audit 
process,  refining  them  when  necessary.  It  requires  a 
conscious  decision  to  progress  to  each  stage  of  the  audit 
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process.  The  basic  elements  of  the  audit-by-objectives 
approach  entail: 

Establishing  specific  audit  objectives  and,  if 
appropriate,  a  general  a^dit  objective  for  every  audit. 

Refining  the  audit  objectives  during  the  planning  and 
survey  phases  of  the  audit  based  on  information  gathered 
during  each  phase. 

Making  a  formal  decision  to  either  continue  or  curtail 
the  audit  at  the  end  of  the  planning  phase  and  the  survey 
phase  before  beginning  field  verification. 

Developing  an  audit  plan  to  achieve  the  established 
audit  objectives  and  produce  potential  findings  and 
recommendations . 

Structuring  the  audit  approach  to  determine  whether  a 
major  problem  exists,  the  extent  of  the  problem,  the  basic 
cause  of  the  problem,  and  to  formulate  workable  solutions. 

Reevaluating  the  audit  approach  during  the  early  stages 
of  verification. 

-  Effectively  controlling  the  audit  with  a  series  of  go 
or  no-go  decision  points  before  beginning  each  audit  phase. 
High  level  audit  management  shall  be  involved  at  the 
decision  points  at  the  start  of  the  audit,  at  the  end  of  the 
survey  phase,  and  at  the  end  of  the  field  verification. 

Summarizing  audit  results  in  the  form  of  conclusions 
about  the  general  objective,  if  there  is  one,  and  about  each 
specific  objective.  [Ref.  27:pp.  3-4] 


A.  AUDIT  PLAN 

The  audit  plan  generally  covers  current  high  interest 
issues.  [Ref.  16]  A  limited  selection  of  the  1990  audit  plan 
is  included  in  Section  B  of  this  appendix. 

The  Naval  Audit  Service  also  performs  an  independent 
appraisal  as  part  of  its  annual  audit  plan  to  determine 
whether  the  Management  Control  Program  and  policies  are 
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followed,  and  identified  weaknesses  are  adequately  corrected. 
According  to  the  Director  for  Audit  Policy  at  the  Naval  Audit 
Service,  the  Management  Control  Program  is  assessed  twice. 
Each  program  audit  determines  whether  the  Management  Control 
Program  is  accomplishing  its  goal  and  how  the  program  affects 
the  audit  results.  The  second  assessment  occurs  when  the  Navy 
reports  its  annual  weaknesses.  Auditors  visit  sites  and  look 
at  opinions  and  weaknesses  to  ensure  nothing  is  concealed  or 
hidden.  [Ref.  18] 


B.  NAVAL  AUDIT  SERVICE  INTERNAL  AUDIT  PLAN 

This  is  a  selected  list  of  planned  or  ongoing  audits  for 
1990. 

Hazardous  Waste  Management. 

Objectives:  (1)  evaluate  hazardous  waste  management  as 

related  to  transportation,  treatment,  reuse,  recycling,  and 
disposal;  (2)  evaluate  accuracy  of  hazardous  waste 

generation  reporting;  (3)  evaluate  hazardous  material 
acquisition  and  storage  practices;  (4)  determine  adequacy 
of  hazardous  waste  management  training,  staffing,  and 
funding;  and,  (5)  evaluate  the  ability  of  the  Navy  to 
effectively  comply  with  federal,  state,  and  local 
jurisdictional  requirements. 

DON  Management  Control  Program.  Accounting  Systems  Review 
Process,  and  the  Efficiency  Review  Program. 

Objectives:  (1)  determine  the  reasonableness  and  propriety 

of  the  FY  1989  DON  Management  Control  Certification 
Statement,  (2)  assess  the  basis  for  reporting  accounting 
systems  in  substantial  compliance  with  prescribed  principles 
and  procedures,  and  (3)  determine  the  extent  of  the 
implementation  of  the  DON  Efficiency  Review  Program. 

Follow-up  on  Audit  of  Navv  Budget  Clearing  Accounts. 
Objectives:  determine  if  (1)  Navy  management  took  action  in 

response  to  our  prior  audit  of  Budget  Clearing  Accounts,  and 
(2)  those  actions  corrected  the  reported  deficiencies. 
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Development  and  Implementation  of  the  Automated  Standard 
Civilian  Payroll  System  (NAVSCIPS) . 

Objectives:  determine  whether  (1)  the  NAVSCIPS  project 
objectives  ar  being  effectively  and  efficiently 
accomplished,  and  (2)  the  requirements  for  NAVSCIPS  can  be 
economically  justified. 

Budgeting  and  Contracting  for  Navy  Base  Operating  Services. 
Objectives:  determine  (1)  if  budgeted  funds  adequately 
support  operational  requirements,  (2)  if  contract  award 
procedures  are  proper,  (3)  if  work  and  services  billed  are 
actually  performed,  (4)  if  contractors  are  properly  paid, 
and  (5)  if  the  contract  administration  function  is 
otherwise  properly  performed. 

Manage-to-Pavroll  in  the  Navv. 

Objectives:  determine  (1)  if  Manage-to-Payroll  is  a  viable 
method  of  controlling  civilian  payroll  costs,  (2)  if 
commands  have  adequately  implemented  Manage-to-Payroll,  and 
(3)  if  personnel  resources  are  managed  efficiently  and 
effectively  under  the  program.  [Ref.  33] 
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APPENDIX  C 


EXAMPLES  OF  VULNERABILITY  ASSESSMENT 
FORM  AND  BASIC  CERTIFICATION  LETTER 


The  following  pages  provide  examples  of  the  vulnerability 
assessment  form  and  format  for  the  basic  certification  letter 
as  suggested  in  SECNAVINST  5200. 3 5B,  dated  25  March  1988. 
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VULNERABILITY  ASSESSMENT  FORM 


1  ORGANIZATION 


X.  QUO  APIA  now  coot 


3.  PROGRAM' 
FUNCTION; 
ACTIVITY 
lumuiu  uwrn 


»> 


* 

K 


o 

O 


z 

ID 

o 


4.  EMPHASIS  ON  INTERNAL  CONTROLS: 

MAJOR  EMPHASIS 


MOO€ RATE  EMPHASIS 


MINOR  EMPHASIS 


S. 


COVERAGE  BY  WRITTEN  PROCEDURES: 

SPECIFIC  GUIOANCE  W/  LITTLE  OR  NO 
DISCRETION _  _ 


FLEXIBLE  GUIDANCE  W;  SIGNicICANT 
DISCRETION 


NO  WRITTEN  PROCEDURES 


SPECIFYING  GOALS  AND  MEASURING 
ACCOMPLISHMENTS: 
not  applicable 


goalsobjectives  formally  established 

AND  MONITORED 


GOALS; OBJECTIVES  USE  INFORMALLY  OR 
W  LITTLE  FOLLOWUP 


GOALS-OBJECTIVES NEEDED  BUT 
NOT  ESTABLISHED 


0) 


(3) 


(SI 


-Li!. 


(3) 


(5) 


(I) 


(31 


(5) 


7.  ADEQUACY  OF  CHECKS  AND  BALANCES: 

NOT  APPLICABLE 


ADEQUATE 


NEEDS  IMPROVEMENT 


REQUIRED  BUT  TOTALLY  LACKING 


ADP  USED  FOR  REPORTING  OR 
OPERATIONAL  DATA: 

NOT  APPLICABLE 


DATA  RELIABILITY  (TIMELINESS.  ACCURACY  AND 
SECURITY  ARE  SATISFACTORY 


DATA  RELIABILITY  or  SECURITY  NEEDS  SOME 
IMPROVEMENT 


DATA  RELIA8LITY /SECURITY  IS  AMAJOR  PROBLEM 


PERSONNEL  RESOURCES 

ADEQUATE  NUMBER  OF  QUALIFIED  PERSONNEL 


ADEQUATE  NO  OF  PERSONNEL  BUT  SOME” 
TRAINING  REQUIRED 


INSUFFICIENT  NO  OF  PERSONNEL  OR  MAJORITY 
OF  STAFF  LACKS  QUALIF  OR  NEEDED  TRAINING 


(M 


(31 


(S) 


(1) 


(31 


(5) 


(M 


(3) 


(51 


x 

IT 

£ 


3 

V) 

in 


10.  PROGRAM  ADMINISTRATION: 

DON  ONLY 


(1) 


15.  TYPE  OF  TRANSACTION  DOCUMENT 

NON  CONVERTIBLE  TO  CASH  OR  BENEFIT 


JOINT  SERVICE 


(3) 


CONVERTIBLE  TO  SERVICES  ONLY 


THIRD  PARTY  (CONTRACTOR) 
•  HEAVY  INVOLVEMENT 


DIRECTLY  CONVERTIBLE  TO  CASH 


H) 


•  TOTAL  INVOLVEMENT 


IS) 


11.  SCOPE  OF  WRITTEN  AUTHORITY: 

PRECISE 


(II 


IS.  INTERVAL  SINCE  MOST  RECENT 
EVALUATION  OR  AUDIT: 

V  .THIN LAST 9 MONTHS 


BETWEEN  9  AND  24  MONTHS 


CLARIFICATION  REQUIRED 


(3) 


MORE  THAN  2  YEARS 


NO  WHITTEN  AUTHORITY 


(51 


17. 


12. 


AGE/STATUS  OF  PROGRAM : 

RELATIVELY  STABLE 


U) 


RECENT  INSTANCES  OF  ERRORS  OR 
IRREGULARITIES: 

NONE  IN  THE  LAST  1 8  MONTHS 


CHANGING 


(31 


NEW  OR  EXPIRING  WITHIN  2  YEARS 


(51 


MOST  SIGNIFICANT  FINDINGS  OR  KNOWN  ERRORS 
FULLY  CORRECTED  _ 


13. 


EXTERNAL  IMPACT  OR  SENSITIVITY. 

NOT  APPLICABLE 

lqwlevel _ 


MODERATE  LEVEL 


HIGHLEVEL 


14. 


INTERACTION  ACROSS  ORGANIZATIONS 

EXCLUSIVE  TQONE OFFICE _ 


WITHIN  TWQFUNCTIONAL  OFFICES 


MORE  THAN  TWQFUNCTIONAL  OFFICES 


INVOLVEMENT  WITH  OUTSIDE  ORGANIZATIONS 


-121 


(51 


ILL 


-L2L 


(4) 


(51 


MOST  SIGNIFICANT  FINDINGS  OR  KNOWN  ERRORS 
UNRESOLVED 


18. 


ADEQUACY  OF  REPORTS: 

ACCURATE  ANO  TIMELY 


SOMETIMES  INACCURATE.  INCOMPLETE  AND  OR 
LATE  _ 


USUALLY  INADEQUATE  AND  LATE 


19.  TIME  CONSTRAINTS: 

NOT  A  SIGNIFICANT  FACTOR  IN  OPERATIONS 


OCC  ASSION  ALL  Y  A  F  AC  TOR 


A  SK3NIF ICANT  DAILY  FACTOR 


Cl 


(3) 


(5) 


(1) 


(3) 


(51 


J1L 

(31 


15) 


C) 


(3) 

IS) 


Cl 


(3) 


(51 


>OJ| 

i>o 

5*5 

1*0 

W  ! 
£  UJ  U.  I 

*  ifl  </» 


20.  ASSUMED  EFFECTIVENESS  OF 
EXISTING  CONTROLS 

CONTROLSAOEQUATE 


Cl 


LESS  THAN  ADEQUATE 


(31 


NO  EXISTING  CONTROLS  OR  COSTS 
OUTWEIGH  BENEFITS 


151 


21.  OVERALL  VULNERABILITY 
ASSESSMENT: 

LOW  Q  (LESS  THAN  ?T| 

MEDIUM  G  IT7  3*1 

HK3W  □  (GREATER  THAN  VI 


22.  wcrrecomwenoed? 


»tl  0  «0 


SCORE 


23. 


H  VA  COHOUCTtO  §r 


0#lt 


IS  VA  APPWOVtO 


Obi* 


NAVCOMPT  rO«M  2293  i  ««i 
S  N  010«  L9  702  2830 
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5200 

Ser/Orig  Code 
(Date ) 


FORMAT  OF  BASIC  CERTIFICATION  LETTER 


From:  Responsible  Official  (Component  Head  or  Deputy) 

To:  (Next  higher  level  in  the  chain  of  command) 

Sub j :  MANAGEMENT  CONTROL  CERTIFICATION  STATEMENT 

Ref:  (a)  SECNAVINST  5200. 35B 

Enel:  (1)  Current  Year  Accomplishments/Material  Weaknesses 
Identified  and  Corrected 

(2)  Current  Year  Material  Weaknesses  and  Corrective  Actions 

(3)  Prior  Year(s)  Material  Weaknesses  -  Status  of  Corrective 
Actions 

(4)  Risk  Assessment  Report  and  Management  Control  Plan 

1.  The  (title  of  component)  has  evaluated  the  system  of  internal 
administrative  and  accounting  control  in  effect  during  the  Fiscal 

Year  ending  30  September  19 _ .  The  evaluation  was  performed  per 

Department  of  the  Navy  policy  contained  in  reference  (a).  Infor¬ 
mation  to  support  the  statement  was  derived  from  the  management 
control  program,  audits,  inspections,  investigations,  and  other 
management  reviews.  Except  for  identified  material  weaknesses, 
the  system  of  internal  control  in  effect  during  the  fiscal  year 
provided  reasonable  assurance  that  the  objectives  of  the  Federal 
Managers'  Financial  Integrity  Act  were  achieved. 

2.  Enclosure  (1)  provides  19 _  management  control  program  accom¬ 

plishments  and  material  weaknesses  identified  and  corrected  this 
fiscal  year.  Material  weaknesses  with  ongoing  corrective  actions 
identified  this  fiscal  year  and  the  status  of  corrective  actions 
for  prior  year(s)  weaknesses  are  reported  in  enclosures  (2)  and 
(3),  respectively.  Enclosure  (4)  provides  the  risk  assessment 
report  and  Management  Control  Plan  for  this  fiscal  year. 

Signed 

Component  Head  or  Deputy 
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FORMAT  FOR  REPORTING  ACCOMPLISHMENTS  OR  MATERIAL  WEAKNESSES 


1. 

2. 


Title  of  the  accomplishment  or  weakness. 


Source . 


-  Provide  the  source (s)  used  to  identify  this  accom* 
plishment  or  material  weakness,  e.g.,: 


•  Management  Control  Review 
°  DOD(IG)  finding 

0  Naval  Audit  Service  finding 
0  GAO  finding 

*  Internal  Review  finding 
0  Service  IG  finding 

0  Other 


Description . 


-  Provide  a  brief  statement  describing  the  accomplish¬ 
ment  or  material  weakness. 


4 .  Corrective  actions: 

COMPLETION 

MILESTONES  DATES _ 

-  Provide  corrective  actions  for  material  weaknesses  in 
the  form  of  milestones  with  an  estimated  completion 
date  for  each  milestone. 
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APPENDIX  D 


MANAGEMENT  CONTROL  PROGRAM — 

CRITERIA  TO  DETERMINE  THE  MATERIALITY  OF  WEAKNESSES 

(a)  Actual  or  potential  loss  of  resources 

(b)  Sensitivity  of  the  resources  involved 

(c)  Magnitude  of  funds,  property,  or  other  resources 
involved 

(d)  Frequency  of  actual  and/or  potential  loss 

(e)  Current  or  probable  media  interest  (adverse  publicity) 

(f)  Unreliable  information  causing  unsound  management 
decisions 

(g)  Diminished  credibility  or  reputation  ot  management 

(h)  Impaired  fulfillment  of  essential  mission 

(i)  Violation  of  statutory  or  regulatory  requirements 

(j)  Impact  on  information  security 

(k)  Failure  of  the  Government  to  provide  the  public  with 
needed  services 

(l)  Apparent  conflict  of  interest.  [Ref.  22] 
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APPENDIX  E 


SELECTIONS  FROM  THE  1989  NAVY  MANAGEMENT 
CONTROL  CERTIFICATION  STATEMENT 


The  following  material  weaknesses  were  selected  from  the 

1989  Navy  Management  Control  Certification  Statement. 

1.  Reporting  Category:  Procurement 

2.  Title:  Asset  Capitalization  Program 

3.  Source:  GAO  Audit  NSIAD  89-147,  Plant  Modernization: 
DOD's  Management  of  the  Asset  Capitalization  Program 
Needs  Improvement,  August  1989 

4.  Description:  The  Asset  Capitalization  Program  (ACP) 
does  not  have  all  the  essential  elements  of  a  sound 
capital  investment  management  program.  The  program 
lacked  top  management  support  and  organizational 
responsibilities  were  unclear.  It  lacked  a  systematic 
approach  to  identifying  investment  opportunities, 
including  long  range  activity  modernization  plans. 

Some  activities  had  inadequate  and  inaccurate 
accounting  records  for  depreciation  expenses  and  plant 
property.  Many  project  files  did  not  contain  complete 
information  on  the  history  of  each  project,  date  of 
receipt,  installation  and  initial  operation  or  were 
missing  invoice  documents  because  the  activities  either 
lacked  specific  or  adequate  guidance  on  what  should  be 
contained  in  the  files. 

5.  Potential  Conseguences :  Investment  opportunities  may 
be  missed.  Equipment  items  would  not  be  depreciated 
and,  in  some  cases,  equipment  would  not  be  accounted 
for. 

6.  Related  Appropriation ( s) :  Navy  Industrial  Fund 

7 .  Corrective  Actions: 


MILESTONES  STATUS 

Direct  commands  to  comply  with  existing  31  Mar  1990 

guidance  to  ensure  that  capital 
investments  are  consistent  with  the 
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activities'  strategic  plans  and  that 
projects  are  implemented  in  a  timely 
manner. 

Direct  commands  to  comply  with  existing  31  Mar  1990 

internal  control  procedures,  develop 

procedures  to  verify  that  actual  costs 

of  equipment  are  recorded  on  depreciation 

and  plant  property  records,  and 

follow-up  to  ensure  internal  control 

procedures  are  being  followed. 

Direct  commands  to  assign  sufficient  30  Jun  1990 

personnel  to  manage  and  execute 
the  program. 
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1.  Reporting  Category:  Supply  Operations 

2.  Title:  Receipt  Confirmation 

3.  Source :  GAO  Audit  NSIAD  88-179,  Inventory  Management, 
Receipt  Confirmation  problems,  July  1988;  and  DoDIG 
Audit  89-114,  Control  Over  Spares  For  New  Weapon 
Systems,  22  Sep  1989 

4.  Description:  Under  the  source  acceptance  method  of 
expedited  receipt,  payments  are  made  based  on 
government  inspection  and  acceptance  of  material  at 
vendors'  plants  rather  than  upon  receipt  at  government 
facilities.  Navy  systems  did  not  have  adequate 
controls  to  ensure  that  depots  received  material  paid 
for  on  the  basis  of  source  acceptance.  Additionally, 
controls  over  initial  spares  shipped  from  contractors 
to  storage  and  user  activities  were  inadequate. 

Internal  control  procedures  had  not  been  established  to 
ensure  that  activities  received  initial  spares  and 
recorded  the  receipts  in  a  timely  manner. 

5.  Potential  Consequence:  Receipt  confirmation  and  timely 
recording  of  receipts  are  the  only  basis  for  assuring 
that  the  government  either  receives  what  it  paid  for  or 
recovers  payments  for  items  not  received. 

6.  Related  Appropriation fs^ :  O&MN;  WPN;  APN;  SCN;  and  OPN 

7 .  Corrective  Actions: 


MILESTONES 


Establish  interim  procedures  to  ensure 
follow-up  and  recognition  of  in-transit 
source  accepted  shipments. 

Implement  revised  Navy  systems 
containing  automated  procedures  to 
accomplish  the  necessary  reconciliation 
and  follow-up  of  in-transit  source 
accepted  shipments. 

Establish  and  Implement  controls  to 
require  storage  and  user  activities 
to  acknowledge  and  record  initial  spares 
receipts  within  60  days  of  date  of 
shipment. 

Establish  a  system  to  follow-up  on 
initial  spares  shipments  that 


STATUS 


Completed 


30  Sep  1991 


30  Dec  1990 


30  Dec  1990 
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storage  and  user  activities  have  not 
acknowledged  as  being  received. 
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1.  Reporting  Category:  Personnel  and/or  Organization 
Management 

2.  Title :  Reinvestigating  Top  Secret  Clearances 

3.  Source :  Command  Inspections,  Staff  Oversight  Reviews 
and  Management  Analyses 

4.  Description:  Prior  to  July  1989,  the  Navy  did  not  have 
a  central  file  identifying  military  and  civilian 
personnel  with  Top  Secret  security  clearances.  With 
the  centralization  of  clearance  determinations 
performed  by  the  Department  of  the  Navy  Central 
Adjudication  Facility  (CAF) ,  a  personnel  security 
clearance  data  base  now  exists.  However,  due  to 
resource  constraints  and  higher  priorities,  a  program 
has  not  yet  been  established  which  will  identify  those 
individuals  whose  background  investigations  require 
updating,  systematically  notify  commands  to  initiate 
reinvestigations,  and  monitor  command  control  for 
ensuring  initiation  of  reinvestigations. 


5.  Potential  Consequences:  One  command  identified  almost 
3700  personnel  holding  Top  Secret  clearances  without 
having  been  subjected  to  a  periodic  reinvestigation 
within  the  past  five  years.  This  condition  could 
result  in  the  failure  to  identify,  in  a  timely  fashion, 
cleared  personnel  who  may  no  longer  be  eligible  for 
clearance  due  to  disqualifying  activities. 

6.  Related  Appropriation ( s) :  O&MN 

7 .  Corrective  Actions: 


MILESTONES 


STATUS 


Establish  a  centralized  data  base  of  Completed 

personnel  holding  Top  Secret  clearances. 

Identify  all  personnel  holding  Top  1  Jan  1990 

Secret  clearances  without  reinvestigations. 


Identify  all  personnel  having  Top  Secret  1  Jun  1990 
clearances  whose  background  investigations 
or  secret  background  investigations  were 
accomplished  prior  to  1984. 

Establish  procedures  to  notify  commands  to  1  Jul  1990 
request  Defense  Investigative  Service  to 
conduct  Periodic  Reinvestigations  (PRs) . 
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Establish  procedures  to  ensure  reinvesti-  1  Dec  1990 
gations  are  conducted  as  required. 
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1.  Reporting  Category:  Supply  Operations  (OSD  88-15) 

2.  Title  of  Weakness:  Cataloging  of  supply  items 

3.  Source:  Department  of  Defense  Inspector  General  Audit 
Report  88-053 

4.  Description:  The  system  of  internal  controls  was  not 
adequate  to  ensure  that  supply  items  were  sufficiently 
or  accurately  cataloged  within  the  Federal  Catalog 
System.  Items  were  insufficiently  described, 
inaccurately  cataloged,  prematurely  cataloged,  and 
unnecessarily  assigned  a  national  stock  number. 

5.  Potential  Consequence:  Improper  cataloging  of  supply 
items  increases  the  risk  of  undetectable  duplication  of 
national  stock  numbers  in  the  supply  system,  is  a  poor 
use  of  resources,  and  degrades  the  quality  of  data  by 
which  users  determine  if  items  meet  their  requirements. 

6 .  Corrective  Actions: 


MILESTONES 


STATUS 


Establish  internal  controls  to  ensure  30  Jun  1989 

that  available  manufacturers'  data  are  Completed 

obtained/used  during  the  cataloging 
process  to  facilitate  the  appropriate 
identification  of  items. 


Establish  internal  controls  to  ensure  that  30  Jun  1989 
the  identification  of  previously  cataloged 
completed  items  are  upgraded  when  the 
requisite  additional  data  becomes 
available . 


Implement  internal  controls  to  ensure  that  30  Jun  1989 
a  quality  assurance  program,  as  specified  Completed 
by  DOD  Manual  4130. 2-M,  is  employed. 


Implement  internal  controls  to  assign  30  Jun  1989 

item  management  codes  in  accordance  Completed 

with  the  criteria  included  in  DOD 
Directive  4140.26,  "Integrated  Material 
Management  of  Consumable  Items." 


74 


1. 


Reporting  Category:  Property  Management  (OSD  88-24) 


2.  Title  of  Weakness:  Inadequate  procedures  for  control, 
storage  and  disposal  of  hazardous  waste 

3.  Source :  GAO  Survey  Code  392337,  Naval  Inspector 
General  finding;  Management  Control  Reviews 

4.  Description ;  Proper  storage  facilities  are  not  always 
adequate  or  don't  exist?  procedures  for  control  and 
disposal  are  sometimes  inadequate;  hazardous  wastes  are 
not  properly  stored  and  secured  at  confirming  sites 
while  awaiting  usage  or  disposal;  hazardous  waste  is 
not  always  properly  labeled;  lack  of  checklist  to 
conduct  annual  reviews  of  hazardous  waste  and  material; 
and  lack  of  procedures  for  control  and  disposal  of 
hazardous  waste. 

5.  Potential  Consequence :  Inadequate  storage  of 
incompatible  chemicals  could  result  in  a  fire/explosion 
and  inadequate  disposal  of  hazardous  waste  could  be  a 
cause  for  air/water  pollutants. 

6 .  Corrective  Actions : 


MILESTONES  STATUS 

Update  hazardous  material  inventories  to  Completed 

list  correct  method  of  storage  and  disposal. 

Review  hazardous  chemicals  inventories?  turn  Completed 
in  for  disposal  all  chemicals  that  are  not 
required  for  current  needs. 

Prepare  standard  checklist  to  be  used  to  15  Dec  1989 
conduct  annual  reviews  of  hazardous  waste  Completed 

and  material  and  require  all  commands 
and  activities  to  conduct  annual  reviews. 

A  Navy  standard  checklist  has  been  completed. 

The  requirement  for  activities  to  conduct 
annual  reviews  has  been  included  in  the 
Environmental  Compliance  Evaluation  System. 

OPNAVNOTE  5090,  of  20  June  1989,  provides  a 
means  to  monitor,  achieve  and  maintain 
compliance  with  environmental  regulations. 

Supplemental  checklists  covering  many  of  the 
states  are  now  available,  the  remaining  (5) 
state  checklists  will  be  developed  under 
contract  by  December  1990  assuming  that  FY-90 
funds  are  available  by  November  1989.  Based  on 
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the  correct  actions  taken  to  date,  this  milestone 
is  considered  substantially  complete 


Revise  procedures  for  control  and  disposal 
of  hazardous  material  and  classify  program 
responsibilities 


1  Aug  1989 
Completed 
20  Jun  1989 
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1.  Reporting  Category:  Property  Management  (OSD  88-25) 

2.  Title  of  Weakness;  Lack  of  effective  Missing,  Lost, 
Stolen,  Recovered  Property  (M-L-S-R)  reporting  program 

3.  Source :  Management  Control  Reviews,  Inspection. 

4.  Description :  Procedures  for  processing  missing  and 
damaged  property  are,  in  some  instances,  improper? 
there  is  a  lack  of  loss  prevention  programs;  and  there 
is  no  command  emphasis  and  oversight  in  the  area  of 
accountability. 

5.  Potential  Conseguences:  Failure  to  comply  with 
reporting  requirements  may  result  in  degradation  of  the 
security  program,  continued  and  increased  losses  of 
Government  property,  inability  to  develop  trends  and 
analyses,  and  reduced  capability  to  recover  missing 
property. 

6.  MILESTONES 


Revise  M-L-S-R  guidance  and  assign 
Program  Manager  to  monitor  M-L-S-R 
Reporting  Program. 

Propose  that  M-L-S-R  Reporting  Program  be 
reinstated  as  a  special  interest  item  on 
command  inspections. 


STATUS 

15  Nov  1988 
Completed 
18  Oct  1988 

1  Jan  1989 
Completed 
14  Dec  1988 


Note:  Reported  complete  in  31  March  1989  Status  Report. 
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1. 


Reporting  Category:  Support  Services  (OSD  88-45) 


2.  Title  of  Weakness;  Inadequate  audit  standards, 
performance,  training,  and  reporting 

3.  Source :  Naval  Audit  Service  Reports  C37116,  013-C-88, 
006-N-88,  023-C-88;  General  Accounting  Office  Review  of 
the  Effectiveness  of  the  Naval  Audit  Service; 

Department  of  Defense  Inspector  General  quality 
assurance  reviews 

4.  Description;  The  effectiveness  of  the  Naval  Audit 
Service  non-appropriated  fund,  and  exchange  audit 
components  has  been  hampered  by  the  lack  of  properly 
qualified  and  trained  audit  personnel;  inadequate 
supervision  in  the  planning,  performing  and  reporting 
of  audits;  lack  of  audit  evidence  documentation  and 
standardization  of  audit  reports;  improper  use  of  audit 
personnel  to  perform  nonaudit  tasks;  and  instances  of 
compromise  of  audit  independence. 

5.  Potential  Consequence:  Inadequately  qualified  and 
trained  personnel  are  unable  to  perform  quality  audits 
thereby  diminishing  the  effectiveness  of  the  entire 
audit  program.  Due  to  lack  of  adequate  supervision, 
audits  are  not  planned,  conducted,  and  reports  written 
in  accordance  with  Comptroller  General's  standards  for 
examination  and  evaluation.  Frequent  turnover  in  audit 
personnel  is  experienced.  Lack  of  audit  independence 
jeopardizes  the  integrity  of  the  audit  program. 

6 .  Corrective  Actions: 


MILESTONES  STATUS 

Establish  Naval  Audit  Service  (NAVAUDSVC) ,  Completed 

Commandant  of  the  Marine  Corps  (CMC) ,  Navy 
Resale  and  Services  Support  Office  (NAVRESSO) , 
and  Chief  of  Naval  Operations  (CNO)  documen¬ 
tation  procedures  to  ensure  audit  report 
content  and  format  requirements  are  met. 

NAVAUDSVC  alter  the  composition  of  the  Completed 

annual  audit  plan  to  provide  greater 
potential  for  management  improvement, 
readiness  improvement,  and  monetary  savings. 

NAVAUDSVC  document  the  supervisory  process  Completed 

for  producing  audits  and  properly  oversee 
administrative  functions  to  produce  quality 
audits . 
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Assign  command  control  to  maximize 
NAVAUDSVC ,  CMC,  NAVRESSO  audit  group's 
independence . 

Train  CMC,  NAVRESSO,  CNO  audit  staff  on 
workpaper  preparation  and  filing  standards 
and  establish  procedures  to  control  and 
safeguard  workpapers. 

Institute  procedures  at  NAVRESSO  for  the 
positive  verification  of  prospective 
employees'  educational  qualifications 

Prohibit  use  of  NAVRESSO  audit  personnel 
for  non-auditing  tasks. 

Establish  and  submit  new  staffing  standards 
and  assign  CMC  staff  accordingly. 

Develop  written  procedures  to  guide  CMC, 
NAVRESSO,  CNO  auditors  in  recognizing 
potential  instances  of  fraud,  waste,  and 
illegal  acts,  extending  audit  steps,  and 
notifying  DOD  investigative  agencies. 

Develop  and  implement  a  formal  training 
program  for  both  auditors  and 
supervisors  at  NAVAUDSVC,  CMC,  NAVRESSO. 


Completed 


Completed 

Completed 

Completed 

Completed 

1  Dec  1988 
Completed 
22  Dec  1988 

30  Sep  1990 
On  target 
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1. 


Reporting  Category:  Support  Services  (OSD  #87-49) 


2.  Title  of  Weakness:  Management  of  certain  aspects  of 
health  care  operations 

3.  Source :  NAVAUDSVC  Report  T38086  and  Command 

Inspection  Report 

4.  Description ;  Effective  management  oversight  was 
lacking  in  certain  Navy  health  care  operations  thereby 
hampering  development  and  implementation  of  a 
comprehensive  health  care  management  plan.  Appropriate 
analytical  techniques  and  information  resources  were 
either  not  used  or  were  unavailable  to  monitor  and 
improve  the  delivery  of  health  rare.  A  centralized 
automated  information  system  did  not  exist  to  collect 
and  analyze  malpractice  data,  impairing  the  Navy's 
ability  to  assure  quality  care  and  reduce  the  risk  of 
financial  loss  from  claims.  Support  for  the  increasing 
use  of  medical  services  contracts  was  inadequate. 
Procedures  related  to  replacing,  maintaining  and 
controlling  medical  and  dental  investment  equipment 
were  inadequate  or  were  not  being  followed.  Also,  the 
medical/dental  manpower  planning  function  was  found  to 
be  fragmented  and  ineffective.  Medical  unit 
requirements  were  not  being  developed  against  wartime 
missions  resulting  in  potential  wartime  shortages  in 
critical  medical  subspecialties.  Appropriate  policy 
direction,  oversight  and  resource  advocacy  for 
Operational  Medicine  (OM)  was  lacking.  Shortfalls  in 
OM  capabilities  adversely  impact  the  warfighting 
capability  of  the  Navy  and  Marine  Corps. 

5 .  Corrective  Actions: 

MILESTONES 

Develop  a  system  to  track  medical 
personnel  status  and  requirements 
relative  to  both  peacetime  and 
wartime  billets  and  deployments. 

Increase  the  visibility  and  support 
of  OM  to  enhance  its  capability  and 
heighten  the  level  and  quality  of 
medical  support  to  the  operating  forces. 

Ensure  manpower  authorizations  reflect 
a  reserve  requirement  when  a  wartime 
billet  cannot  be  filled  from  active  duty 
end-strength. 


STATUS 

Completed 


Completed 


1  Dec  1989 
Revised  to 
1  Oct  1990 


80 


The  entire  shore  organization  of 
Navy  medicine  is  being  reorganized. 

Some  organizations  will  be  realigned, 
some  will  be  disestablished  and  others 
will  be  provided  different  missions. 

When  manpower  authorizations  are  finalized, 
the  active/reserve  configurations  will  be 
ensured. 

Evaluate  and  reemphasize  procedures 
for  management  and  control  of  health 
care  equipment. 

Analyze  the  difference  between  peacetime 
and  wartime  manpower  requirements  and 
develop  a  plan  to  bridge  the  gap. 

Establish  procedures  and  develop  a 
management  information  system  to 
ensure  appropriate  health  care  quality 
indicators  are  reviewed,  analyzed  and 
acted  upon. 

Guidance  issued  prescribing  format 
and  content  of  the  Management  Infor¬ 
mation  Report  (MIR) .  MIR  submissions 
due  1  February  1990  will  be  reviewed 
for  thoroughness,  utility,  and  docu¬ 
mentation  of  appropriate  action  by 
oversight  activities  during  review  and 
endorsement.  Assessment  of  MIRs  utility 
expected  by  1  May  1990. 

Develop  a  manpower  planning  system  which 
requires  the  use  of  staffing  standards, 
identifies  shortfalls,  prioritizes 
current  and  future  workload  and  integrates 
reserve  and  active  forces. 

The  ASD(HA)  health  care  standards 
are  being  used  in  the  present  Navy 
Manpower  Management  Operating  System. 
However,  a  manpower  planning  system 
meeting  the  milestone  requirements 
will  not  be  in  place  until  the  Navy's 
reorganization  of  the  medical  depart¬ 
ment  is  completed. 

Establish  a  centralized  automated  system 
to  collect  and  analyze  malpractice  data. 


Completed 


1  Dec  1989 
On  target 


30  Dec  1990 
Revised  to 
1  May  1990 


1  Dec  1989 
Revised  to 
1  Oct  1990 


1  Oct  1990 
On  Target 
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1. 


Reporting  Category:  Property  Management  (OSD  #86-25) 


2.  Title  of  Weakness:  inaccurate  control  and 
accountability  over  tool  inventories 

3.  Source :  Audits  and  Management  Control  Reviews 

4.  Description;  Controls  and  accountability  over  tool 
inventories  are  inadequate.  Adequate  policies, 
procedures  and  accountability  for  tools  are  not 
established.  Comprehensive  physical  inventories  are 
not  conducted  periodically.  Controls  are  inadequate  or 
have  not  been  implemented  for  reporting  lost,  damaged 
or  stolen  tools.  Reports  on  missing,  lost,  stolen  or 
recovered  tools  and  inventory  discrepancies  were  not 
made  and  investigated.  Automated  tool  control  systems 
do  not  provide  for  complete  accountability  and  control 
of  millions  of  dollars  of  tools.  Centralized 
accountability,  control  and  receipt  over  all  tools  is 
not  established  at  all  activities.  Employee 
accountability  for  lost  tools  is  not  enforced.  Follow¬ 
up  procedures  are  not  in  effect  to  ensure  that  tools 
are  returned  within  established  issue  periods. 

5 .  Corrective  Actions; 


MILESTONES 


CNO  designate  a  command  to  serve  as 
the  Navy  focal  point  for  tool  control 
accountability. 

Determine  adequacy  of  controls  neces¬ 
sary  to  maintain  accountability  over 
tool  inventories  and  evaluate  cost/ 
benefits . 

CNO  develop  and  issue  a  comprehensive 
instruction  covering  policy,  procedures 
and  accountability  for  tools. 


STATUS 

Completed 


Completed 


1  Jun  1989 
Completed 
10  Mar  1989 


Note:  Reported  complete  in  31  March  1989  Status  Report. 
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1. 


t 


1 


Reporting  Category:  Comptroller/Resource  Management 
(OSD  #85-50) 

2.  Title  of  Weakness:  Travel  advances 

3.  Source:  Audit  and  Management  Control  Reviews 

4.  Description:  Weaknesses  in  the  control  of  travel  and 
travel  advances  were  pervasive  throughout  the  DON. 
Insufficient  controls  existed  to  ensure  that  Permanent 
Change  of  Station  (PCS)  and  Temporary  Duty  for 
Instruction  (TEMDUINS)  travel  advances  are  liquidated 
in  a  timely  manner.  Procedures  for  follow-up  and 
settlement  of  outstanding  travel  advances  and 
management  of  travel  funds  were  found  to  be  inadequate. 

5 .  Corrective  Actions: 


MILESTONES 


STATUS 


CNO  develop  a  plan  of  action  and  mile-  30  Sep  1988 

stones  to  address  travel/travel  advance  Completed 

related  deficiencies  from  a  Navy-wide 
perspective  and  complete  appropriate 
corrective  actions. 


CMC  apply  review  emphasis  in  the  areas  30  Sept  1991 

of  follow-up  and  settlement  of  travel  On  Target 

advances  to  obtain  substantial  correction 
of  weaknesses  Marine  Corps-wide. 


Incorporate  improved  travel  control 
and  monitoring  capabilities  in  the 
Standard  Accounting,  Budgeting  and 
Reporting  System  (SABRS) . 

Provide  improved  temporary  addition¬ 
al  duty  computation,  management 
reporting  and  check  production 
capabilities  through  the  Marine 
Corps  Travel  Advance  and  Settlement 
System  (MCTASS) . 


30  Nov  1988 
Completed 


30  Sep  1991 
On  Target 


Source:  [Ref.  34] 


l 
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APPENDIX  F 


ADDITIONAL  READING  LIST 


GAO  Government  Auditing  Standards 

GAO  Standards  for  Internal  Controls  in  the  Federal 
Government,  1983 

GAO/APMD  88-10.  Financial  Integrity  Act.  Continuing 
Efforts  Needed  To  Improve  Internal  Controls  and 
Accounting  Systems 

OMB  Circular  A-123,  revised  16  August  1983 

DODD  7040.6,  Internal  Control  Systems,  24  March  1982 

DODD  7600.2,  Audit  Policies,  10  January  1985 

DODD  7600. 7-M,  Internal  Audit  Manual,  June  1986 

DODD  7650.3,  Followup  on  General  Accounting  Office,  DOD 
Inspector  General,  Internal  Audit,  and  Internal  Review 
Reports,  5  September  1989 

SECNAVINST  5200. 3 5B,  DON  Management  Control  Program,  25  » 

March  1988 

SECNAVINST  7510. 7D,  DON  Internal  Audit,  9  May  1989 

SECNAVINST  7510.9,  Command  Management  Economy,  Efficiency 
and  Review,  13  April  1989 


; 
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